GHSA-6jp6-9rf9-gc66

Suggest an improvement
Source
https://github.com/advisories/GHSA-6jp6-9rf9-gc66
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-6jp6-9rf9-gc66/GHSA-6jp6-9rf9-gc66.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-6jp6-9rf9-gc66
Aliases
Published
2022-02-25T22:18:50Z
Modified
2024-11-19T19:06:44.383476Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cross-site Scripting in Weblate
Details

Impact

Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.

Patches

The issues were fixed in the 4.11 release. The following commits are addressing it:

  • f6753a1a1c63fade6ad418fbda827c6750ab0bda
  • 9e19a8414337692cc90da2a91c9af5420f2952f1
  • 22d577b1f1e88665a88b4569380148030e0f8389

Workarounds

You can look for crafted user and language names to see if you were affected.

References

  • https://hackerone.com/reports/1486674
  • https://hackerone.com/reports/1486718
  • https://hackerone.com/reports/1485226

For more information

If you have any questions or comments about this advisory: * Open a topic in discussions * Email us at care@weblate.org

Database specific 
{
    "nvd_published_at": "2022-02-25T21:15:00Z",
    "github_reviewed_at": "2022-02-25T22:18:50Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

PyPI / weblate

Package

Name
weblate
View open source insights on deps.dev
Purl
pkg:pypi/weblate

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.11

Affected versions

1.*

1.9

2.*

2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.10.1
2.11
2.12
2.13
2.13.1
2.14
2.14.1
2.15
2.16
2.17
2.17.1
2.18
2.19
2.19.1
2.20

3.*

3.0
3.0.1
3.1
3.1.1
3.2
3.2.1
3.2.2
3.3
3.4
3.5
3.5.1
3.6
3.6.1
3.7
3.7.1
3.8
3.9
3.9.1
3.10
3.10.1
3.10.2
3.10.3
3.11
3.11.1
3.11.2
3.11.3

4.*

4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1
4.1.1
4.2
4.2.1
4.2.2
4.3
4.3.1
4.3.2
4.4
4.4.1
4.4.2
4.5
4.5.1
4.5.2
4.5.3
4.6
4.6.1
4.6.2
4.7
4.7.1
4.7.2
4.8
4.8.1
4.9
4.9.1
4.10
4.10.1