CVE-2023-47623: Scrypted Cross-site Scripting vulnerability

August 5, 2024

Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior (corresponding to @scrypted/core 0.1.142 and prior), a reflected cross-site scripting vulnerability exists in the login page via the redirect_uri parameter. By specifying a url with the javascript scheme (javascript:), an attacker can run arbitrary JavaScript code after the login. As of time of publication, no known patches are available.

References

github.com/advisories/GHSA-ww7p-8gfg-v82r
github.com/koush/scrypted
github.com/koush/scrypted/blob/v0.55.0/plugins/core/ui/src/Login.vue
nvd.nist.gov/vuln/detail/CVE-2023-47623
securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted

Code Behaviors & Features

Detect and mitigate CVE-2023-47623 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →