GHSA-pf56-h9qf-rxq4: Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

October 7, 2024

Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.

References

github.com/advisories/GHSA-pf56-h9qf-rxq4
github.com/saltcorn/saltcorn
github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js
github.com/saltcorn/saltcorn/commit/3c551261d0e230635774798009951fa83a07cc3a
github.com/saltcorn/saltcorn/security/advisories/GHSA-pf56-h9qf-rxq4

Code Behaviors & Features

Detect and mitigate GHSA-pf56-h9qf-rxq4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →