CVE-2019-1020005: Cross-site Scripting in invenio-communities
(updated )
A Cross-Site Scripting (XSS) vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and page fields.
References
- github.com/advisories/GHSA-mfv8-q39f-mgfg
- github.com/inveniosoftware/invenio-communities/commit/505da72c5acd7dfbd4148f884c73c9c3372b76f4
- github.com/inveniosoftware/invenio-communities/security/advisories/GHSA-mfv8-q39f-mgfg
- github.com/pypa/advisory-database/tree/main/vulns/invenio-communities/PYSEC-2019-25.yaml
- nvd.nist.gov/vuln/detail/CVE-2019-1020005
Code Behaviors & Features
Detect and mitigate CVE-2019-1020005 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →