Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-esma-wxje-eqh3
Summary
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
A stored XSS vulnerability exists in the User Permissions page. The User Group name is rendered without proper HTML escaping in the permissions section, allowing an attacker to execute arbitrary JavaScript when another user views or edits a user's permissions.

> [!NOTE]
> This is a separate vulnerability from the previously reported "[Stored XSS via User Group Name in User Settings Page](https://github.com/craftcms/cms/security/advisories/GHSA-2423-8xxj-wc3g)" and "[Multiple Stored XSS in User Group Edit Page](https://github.com/craftcms/cms/security/advisories/GHSA-vx7g-xw92-g4xj)". This affects a different sink: the individual user's permissions page.
Aliases
0
alias GHSA-g3hp-vvqf-8vw6
Fixed_packages
0
url pkg:composer/craftcms/cms@5.8.22
purl pkg:composer/craftcms/cms@5.8.22
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39ct-cg7w-kyb6
1
vulnerability VCID-5q5g-jrxm-eyhe
2
vulnerability VCID-a3b5-pwyh-yugv
3
vulnerability VCID-fpea-e48p-kfbn
4
vulnerability VCID-hkp9-3hzv-quhk
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.8.22
Affected_packages
0
url pkg:composer/craftcms/cms@5.0.0-RC1
purl pkg:composer/craftcms/cms@5.0.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-39ct-cg7w-kyb6
3
vulnerability VCID-4wkr-jx1w-77hn
4
vulnerability VCID-5cxe-tjpb-3qan
5
vulnerability VCID-5mnd-qvaq-k3am
6
vulnerability VCID-5q5g-jrxm-eyhe
7
vulnerability VCID-71sv-62m4-z3er
8
vulnerability VCID-7y4f-ef7t-47eb
9
vulnerability VCID-8u2j-17a4-q7eh
10
vulnerability VCID-9enr-b6zd-mbh8
11
vulnerability VCID-a3b5-pwyh-yugv
12
vulnerability VCID-akrv-yqnf-1kg8
13
vulnerability VCID-azr5-12f8-hfbm
14
vulnerability VCID-c2nk-y4rx-1qf4
15
vulnerability VCID-cys8-jnmu-77ec
16
vulnerability VCID-esma-wxje-eqh3
17
vulnerability VCID-fpea-e48p-kfbn
18
vulnerability VCID-h6t5-pdp5-8qhe
19
vulnerability VCID-hkp9-3hzv-quhk
20
vulnerability VCID-hyct-5gap-7kdu
21
vulnerability VCID-jeyh-3jxd-z3g6
22
vulnerability VCID-jsfs-azcs-mfcm
23
vulnerability VCID-jxz8-g6fq-dubw
24
vulnerability VCID-kbrc-85av-nfcn
25
vulnerability VCID-m5rf-usae-yfb7
26
vulnerability VCID-pgm4-svq8-tfc5
27
vulnerability VCID-ppet-ruae-1kav
28
vulnerability VCID-qq68-3j4y-47am
29
vulnerability VCID-qywv-vf4r-8bh9
30
vulnerability VCID-r5hp-5nju-9ubz
31
vulnerability VCID-rb7c-3nkc-gkeg
32
vulnerability VCID-twuy-wzb7-k7g3
33
vulnerability VCID-vasz-rnn1-67ev
34
vulnerability VCID-vvhc-rnpr-ubey
35
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.0.0-RC1
1
url pkg:composer/craftcms/cms@5.8.21
purl pkg:composer/craftcms/cms@5.8.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9enr-b6zd-mbh8
1
vulnerability VCID-cys8-jnmu-77ec
2
vulnerability VCID-esma-wxje-eqh3
3
vulnerability VCID-jeyh-3jxd-z3g6
4
vulnerability VCID-ppet-ruae-1kav
5
vulnerability VCID-twuy-wzb7-k7g3
6
vulnerability VCID-vvhc-rnpr-ubey
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@5.8.21
References
0
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
1
reference_url https://github.com/craftcms/cms/releases/tag/5.8.22
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/releases/tag/5.8.22
2
reference_url https://github.com/advisories/GHSA-g3hp-vvqf-8vw6
reference_id GHSA-g3hp-vvqf-8vw6
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g3hp-vvqf-8vw6
3
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6
reference_id GHSA-g3hp-vvqf-8vw6
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
1
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6
Weaknesses
0
cwe_id 79
name Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score0.1 - 3
Exploitability0.5
Weighted_severity2.7
Risk_score1.4
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-esma-wxje-eqh3