Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
概要
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| dicedzipline |
4.3.0 以上 4.5.0 未満→ 4.5.0 |
4.5.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.
出典: CVE.org (CVE Program・cvelistV5) NVD