medium5.4
CVE-2023-38758
wger Workout Manager Cross-site Scripting vulnerability
Impact
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the `license_author `field in the add-ingredient function in the `templates/ingredients/view.html`, `models/ingredients.py`, and `views/ingredients.py` components.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | wger | <= 2.2.0a3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wger | Workout Manager | Version 2.2.0 |