PT-2023-5949 · Unknown · Scancode.Io
0Xmpij
·
Published
2023-08-14
·
Updated
2023-08-21
·
CVE-2023-40024
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
ScanCode.io versions prior to 32.5.2
Description
The issue arises from inadequate validation and sanitization of the
key parameter in the /license/ endpoint, specifically in the license details view function. This can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist. Attackers can exploit this vulnerability to inject malicious scripts into the response generated by the license details view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.Recommendations
To resolve the issue, upgrade to release 32.5.2 or later. As a temporary workaround, consider restricting access to the
/license/ endpoint or disabling the license details view function until a patch is available. Avoid using malicious javascript in the key parameter to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Scancode.Io