What is GHSA-vqxw-9pg7-v7v9?

GHSA-vqxw-9pg7-v7v9 is a security advisory published by GitHub Security Advisories with Medium severity. Locust Stored Cross-site Scripting Vulnerability

Which CVE IDs does GHSA-vqxw-9pg7-v7v9 cover?

GHSA-vqxw-9pg7-v7v9 covers the following CVE IDs: CVE-2020-28364. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqxw-9pg7-v7v9?

GHSA-vqxw-9pg7-v7v9 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-vqxw-9pg7-v7v9?

GHSA-vqxw-9pg7-v7v9 affects 1 product, including: pip/locust:\u003c 1.3.2.

GHSA-vqxw-9pg7-v7v9MediumCVSS 6.1

Locust Stored Cross-site Scripting Vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 30, 2024

🔗 CVE IDs covered (1)

CVE-2020-28364 →

📋 Description

A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.

🎯 Affected products1

pip/locust:< 1.3.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2020-28364
https://docs.locust.io/en/stable/changelog.html
https://github.com/locustio/locust/pull/1603
https://github.com/locustio/locust/commit/0d118179709b4a60174810bae4db41d40e4c99ad
https://github.com/locustio/locust/commit/4049173b3466da236b1d8d8d3519e73c01525a0d
https://github.com/pypa/advisory-database/tree/main/vulns/locust/PYSEC-2020-60.yaml
https://github.com/advisories/GHSA-vqxw-9pg7-v7v9