Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
Résumé
Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audiobookshelf web application that allows arbitrary JavaScript execution through malicious library metadata. Attackers with library modification privileges can execute code in victim users' browsers, potentially leading to session hijacking and data exfiltration. Version 2.32.0 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com