GHSA-xjgw-ghrx-wfff

Source

https://github.com/advisories/GHSA-xjgw-ghrx-wfff

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-xjgw-ghrx-wfff/GHSA-xjgw-ghrx-wfff.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xjgw-ghrx-wfff

Aliases

CVE-2024-39125
PYSEC-2024-64

Published

2024-07-17T21:31:38Z

Modified

2025-03-20T19:23:32.505566Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Roundup Cross-site Scripting Vulnerability

Details

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.

Database specific

{
    "severity": "MODERATE",
    "nvd_published_at": "2024-07-17T20:15:06Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2024-07-17T23:38:20Z"
}

References

Affected packages

PyPI / roundup

Package

Name: roundup; View open source insights on deps.dev
Purl: pkg:pypi/roundup

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.0

Affected versions

0.*

0.5.9

0.6.8

0.6.9

0.6.11

0.7.0b3

0.7.0

0.7.1

0.7.2

0.7.3

0.7.4

0.7.5

0.7.7

0.7.8

0.7.9

0.7.11

0.7.12

0.8.0b1

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.9.0b1

1.*

1.0

1.0.1

1.1.0

1.1.1

1.1.2

1.2.0

1.2.1

1.3.0

1.3.1

1.3.2

1.3.3

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5.1

1.4.6

1.4.7

1.4.8

1.4.9

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.15

1.4.16

1.4.17

1.4.18

1.4.19

1.4.20

1.4.21

1.5.0

1.5.1

1.6.0

1.6.1

2.*

2.0.0alpha0

2.0.0beta0

2.0.0

2.1.0b1

2.1.0

2.2.0b1

2.2.0

2.3.0b2

2.3.0

2.4.0b1

2.4.0b2