high8.2
CVE-2024-36110
ansibleguy-webui Cross-site Scripting vulnerability
Impact
### Impact Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. ### Patches We recommend to upgrade to version >= [0.0.21](https://github.com/ansibleguy/webui/releases/tag/0.0.21) ### References * [Report](https://github.com/ansibleguy/webui/files/15358522/Report.pdf) * [GitHub Issue 44](https://github.com/ansibleguy/webui/issues/44)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ansibleguy-webui | < 0.0.21 | 0.0.21 |
Affected products
| Product | Affected versions |
|---|---|
| Versions | before 0.0.21 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522
- https://github.com/ansibleguy/webui/files/15358522/Report.pdf
- https://github.com/ansibleguy/webui/issues/44
- https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj
- https://github.com/advisories/GHSA-927p-xrc2-x2gj
- https://nvd.nist.gov/vuln/detail/CVE-2024-36110