PT-2024-40325 · Unknown · Invenio-Communities

Published 2024-06-12 · Updated 2024-06-12

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Invenio-Communities versions prior to 2.8.11 Invenio-Communities versions prior to 4.2.2 Invenio-Communities versions prior to 7.8.0

Description A Cross-Site Scripting (XSS) issue has been identified in certain React components related to community members in the Invenio-Communities module. This issue allows a user to inject a script tag into the Affiliations field during the account registration process. The malicious script is executed when the user creates a new community and is listed as a public member, potentially allowing the attacker to access personal information, such as cookies, of visiting users.

Recommendations For versions prior to 2.8.11, update to version 2.8.11 or later. For versions prior to 4.2.2, update to version 4.2.2 or later. For versions prior to 7.8.0, update to version 7.8.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-HJX6-F647-MVF9

Affected Products

Invenio-Communities

References · 7

• https://osv.dev/vulnerability/GHSA-hjx6-f647-mvf9 · Vendor Advisory
• https://github.com/inveniosoftware/invenio-communities/commit/b89442c9d57421a88dd0aa89a404ba89d1a22cac · Note
• https://github.com/inveniosoftware/invenio-communities/commit/6a47db9404c51134634b3905f62f612b4a976698 · Note
• https://github.com/inveniosoftware/invenio-communities · Note
• https://github.com/inveniosoftware/invenio-communities/commit/817b8208f5ce262f45eab32832d90b80dc7d3fce · Note
• https://github.com/inveniosoftware/invenio-communities/security/advisories/GHSA-hjx6-f647-mvf9 · Note
• https://github.com/inveniosoftware/invenio-communities/commit/4424dd5112818992b82ae42d4c4f89089502b35f · Note