[MAVEN:GHSA-RWH9-8XX8-4WFM] Cross-site Scripting in OpenCRX

Severity Moderate

Affected Packages 5

Fixed Packages 5

CVEs 1

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

Package	Affected Version
pkg:maven/org.opencrx/opencrx-gradle	>= 4.0.0, < 5.2.0
pkg:maven/org.opencrx/opencrx-core-models	>= 4.0.0, < 5.2.0
pkg:maven/org.opencrx/opencrx-core-config	>= 4.0.0, < 5.2.0
pkg:maven/org.opencrx/opencrx-core	>= 4.0.0, < 5.2.0
pkg:maven/org.opencrx/opencrx-client	>= 4.0.0, < 5.2.0

Package	Fixed Version
pkg:maven/org.opencrx/opencrx-gradle	= 5.2.0
pkg:maven/org.opencrx/opencrx-core-models	= 5.2.0
pkg:maven/org.opencrx/opencrx-core-config	= 5.2.0
pkg:maven/org.opencrx/opencrx-core	= 5.2.0
pkg:maven/org.opencrx/opencrx-client	= 5.2.0

ID: MAVEN:GHSA-RWH9-8XX8-4WFM
Severity: moderate
URL: https://github.com/advisories/GHSA-rwh9-8xx8-4wfm
Published: 2021-09-30T20:50:21
(3 years ago)
Modified: 2023-02-01T05:06:20
(19 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://github.com/opencrx/opencrx/commit/14e75f95e5f56fbe7ee897bdf5d858788072e818
			https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25959
			https://github.com/advisories/GHSA-rwh9-8xx8-4wfm

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.opencrx/opencrx-gradle	org.opencrx	opencrx-gradle	>= 4.0.0 < 5.2.0
Fixed	pkg:maven/org.opencrx/opencrx-gradle	org.opencrx	opencrx-gradle	= 5.2.0
Affected	pkg:maven/org.opencrx/opencrx-core-models	org.opencrx	opencrx-core-models	>= 4.0.0 < 5.2.0
Fixed	pkg:maven/org.opencrx/opencrx-core-models	org.opencrx	opencrx-core-models	= 5.2.0
Affected	pkg:maven/org.opencrx/opencrx-core-config	org.opencrx	opencrx-core-config	>= 4.0.0 < 5.2.0
Fixed	pkg:maven/org.opencrx/opencrx-core-config	org.opencrx	opencrx-core-config	= 5.2.0
Affected	pkg:maven/org.opencrx/opencrx-core	org.opencrx	opencrx-core	>= 4.0.0 < 5.2.0
Fixed	pkg:maven/org.opencrx/opencrx-core	org.opencrx	opencrx-core	= 5.2.0
Affected	pkg:maven/org.opencrx/opencrx-client	org.opencrx	opencrx-client	>= 4.0.0 < 5.2.0
Fixed	pkg:maven/org.opencrx/opencrx-client	org.opencrx	opencrx-client	= 5.2.0

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date