GHSA-vxh3-mvv7-265jMediumCVSS 5.4

Cross-site scripting invenio-records

Published
July 16, 2019
Last Modified
September 23, 2024

🔗 CVE IDs covered (1)

CVE-2019-1020003 →

📋 Description

Cross-Site Scripting (XSS) vulnerability in administration interface

Impact

A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.

Patches

All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2

For more information

If you have any questions or comments about this advisory:

🎯 Affected products3

  • pip/invenio-records:< 1.0.2
  • pip/invenio-records:= 1.1.0
  • pip/invenio-records:>= 1.2.0, < 1.2.2

🔗 References (4)