GHSA-68wj-c2jw-5pp9

Suggest an improvement
Source
https://github.com/advisories/GHSA-68wj-c2jw-5pp9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-68wj-c2jw-5pp9/GHSA-68wj-c2jw-5pp9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-68wj-c2jw-5pp9
Aliases
Published
2023-02-18T00:31:59Z
Modified
2025-03-19T15:46:51Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Stored cross site scripting in changedetection.io
Details

Changedetection.io before 0.40.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter under the "Add a new change detection watch" function.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-12T23:33:02Z",
    "nvd_published_at": "2023-02-17T22:15:00Z",
    "severity": "MODERATE"
}
References

Affected packages

PyPI / changedetection-io

Package

Name
changedetection-io
View open source insights on deps.dev
Purl
pkg:pypi/changedetection-io

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.40.2

Affected versions

0.*
0.38.2
0.39
0.39.1
0.39.2
0.39.3
0.39.4
0.39.5
0.39.6
0.39.7
0.39.8
0.39.9
0.39.10
0.39.10.post1
0.39.10.post2
0.39.11
0.39.12
0.39.13
0.39.13.1
0.39.14
0.39.14.1
0.39.15
0.39.16
0.39.17
0.39.17.1
0.39.17.2
0.39.18
0.39.19
0.39.19.1
0.39.20
0.39.20.1
0.39.20.2
0.39.20.3
0.39.20.4
0.39.21
0.39.21.1
0.39.22
0.39.22.1
0.40.0
0.40.0.1
0.40.0.2
0.40.0.3
0.40.0.4
0.40.1.0
0.40.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-68wj-c2jw-5pp9/GHSA-68wj-c2jw-5pp9.json"