GHSA-vq76-5ghr-9p4v

Suggest an improvement
Source
https://github.com/advisories/GHSA-vq76-5ghr-9p4v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vq76-5ghr-9p4v/GHSA-vq76-5ghr-9p4v.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vq76-5ghr-9p4v
Aliases
Published
2022-05-13T01:07:29Z
Modified
2024-05-14T21:14:04.875928Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Openstack Manila Persistent XSS in Metadata field
Details

Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.

Database specific
{
    "nvd_published_at": "2017-04-21T15:59:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T20:38:07Z"
}
References

Affected packages

PyPI / manila-ui

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.1

Affected versions

0.*

0.1.0

1.*

1.0.0
1.0.1
1.1.0
1.2.0

2.*

2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0