Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
Summary
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| dicedzipline |
≥ 4.3.0, < 4.5.0→ 4.5.0 |
4.5.0 |
Original description The description as published by the source.
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.
Source: CVE.org (CVE Program・cvelistV5) NVD