medium6.1
CVE-2024-26318
Cross-site Scripting in Serenity
Impact
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Serenity.Net.Core | < 6.8.0 | 6.8.0 |
| npm | @serenity-is/corelib | < 6.8.0 | 6.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Serenity | Serenity | before 6.8.0 |