Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
{
"unresolved_ranges": [
{
"source": "CPE_STRING",
"vendor_product": "humhub:humhub",
"extracted_events": [
{
"introduced": "0.20.0-beta1"
},
{
"last_affected": "0.20.0-beta1"
},
{
"introduced": "0.20.0-beta2"
},
{
"last_affected": "0.20.0-beta2"
},
{
"introduced": "1.0.0-beta1"
},
{
"last_affected": "1.0.0-beta1"
},
{
"introduced": "1.0.0-beta2"
},
{
"last_affected": "1.0.0-beta2"
}
],
"cpes": [
"cpe:2.3:a:humhub:humhub:0.20.0:beta1:*:*:*:*:*:*",
"cpe:2.3:a:humhub:humhub:0.20.0:beta2:*:*:*:*:*:*",
"cpe:2.3:a:humhub:humhub:1.0.0:beta1:*:*:*:*:*:*",
"cpe:2.3:a:humhub:humhub:1.0.0:beta2:*:*:*:*:*:*"
]
}
]
}{
"cpe": [
"cpe:2.3:a:humhub:humhub:0.20.0:*:*:*:*:*:*:*",
"cpe:2.3:a:humhub:humhub:0.20.1:*:*:*:*:*:*:*"
],
"source": [
"CPE_STRING",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0.20.0"
},
{
"last_affected": "0.20.0"
},
{
"introduced": "0.20.1"
},
{
"last_affected": "0.20.1"
}
]
}