What is GHSA-rwh9-8xx8-4wfm?

GHSA-rwh9-8xx8-4wfm is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in OpenCRX

Which CVE IDs does GHSA-rwh9-8xx8-4wfm cover?

GHSA-rwh9-8xx8-4wfm covers the following CVE IDs: CVE-2021-25959. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rwh9-8xx8-4wfm?

GHSA-rwh9-8xx8-4wfm has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-rwh9-8xx8-4wfm?

GHSA-rwh9-8xx8-4wfm affects 5 products, including: maven/org.opencrx:opencrx-core:\u003e= 4.0.0, \u003c 5.2.0; maven/org.opencrx:opencrx-core-models:\u003e= 4.0.0, \u003c 5.2.0; maven/org.opencrx:opencrx-core-config:\u003e= 4.0.0, \u003c 5.2.0; maven/org.opencrx:opencrx-client:\u003e= 4.0.0, \u003c 5.2.0; maven/org.opencrx:opencrx-gradle:\u003e= 4.0.0, \u003c 5.2.0.

GHSA-rwh9-8xx8-4wfmMediumCVSS 6.1

Cross-site Scripting in OpenCRX

Vendor

GitHub Security Advisories

Published

September 30, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-25959 →

📋 Description

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

🎯 Affected products5

maven/org.opencrx:opencrx-core:>= 4.0.0, < 5.2.0
maven/org.opencrx:opencrx-core-models:>= 4.0.0, < 5.2.0
maven/org.opencrx:opencrx-core-config:>= 4.0.0, < 5.2.0
maven/org.opencrx:opencrx-client:>= 4.0.0, < 5.2.0
maven/org.opencrx:opencrx-gradle:>= 4.0.0, < 5.2.0

🔗 References (3)

https://github.com/opencrx/opencrx/commit/14e75f95e5f56fbe7ee897bdf5d858788072e818
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25959
https://github.com/advisories/GHSA-rwh9-8xx8-4wfm