PT-2023-32997 · Unknown · Whatsapp-Chat-Exporter

Publicado 2023-07-10 · Atualizado 2023-07-10

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WhatsApp-Chat-Exporter versions prior to 0.9.5

Description A Cross-Site Scripting (XSS) issue was discovered in the HTML output of chats, due to the absence of autoescape=True when setting the environment, which is intended to be mitigated by Jinja's escape function. Although the actual impact is considered low because the HTML file is viewed offline, an adversary may still inject malicious payloads into the chat through WhatsApp. All users are affected.

Recommendations For versions prior to 0.9.5, update the exporter to version 0.9.5 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

GHSA-8C6X-G4FW-8RF4

Produtos afetados

Whatsapp-Chat-Exporter

Referências · 4

• https://github.com/KnugiHK/WhatsApp-Chat-Exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79 · Nota
• https://github.com/KnugiHK/WhatsApp-Chat-Exporter · Nota
• https://github.com/KnugiHK/WhatsApp-Chat-Exporter/security/advisories/GHSA-8c6x-g4fw-8rf4 · Nota
• https://osv.dev/vulnerability/GHSA-8c6x-g4fw-8rf4 · Aviso do Fabricante