CVE-2023-47620: Scrypted Cross-site Scripting vulnerability

August 5, 2024

Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner' and 'pkg parameters. An attacker can run arbitrary JavaScript code. As of time of publication, no known patches are available.

References

github.com/advisories/GHSA-xmhh-xrcc-mx36
github.com/koush/scrypted
github.com/koush/scrypted/blob/71cbe83a2a20f743342df695ca7b98482b73e60f/server/src/plugin/plugin-http.ts
nvd.nist.gov/vuln/detail/CVE-2023-47620
securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted

Code Behaviors & Features

Detect and mitigate CVE-2023-47620 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →