GHSA-69ww-wv3j-mhg4

Source

https://github.com/advisories/GHSA-69ww-wv3j-mhg4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-69ww-wv3j-mhg4/GHSA-69ww-wv3j-mhg4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-69ww-wv3j-mhg4

Aliases

CVE-2020-13870

Published

2022-05-24T17:19:26Z

Modified

2024-04-24T18:28:58.996304Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Comments plugin stored Cross-site Scripting (XSS) via an asset volume name

Details

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.

Database specific

{
    "nvd_published_at": "2020-06-05T19:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T18:00:55Z"
}

References

Affected packages

Packagist / verbb/comments

Package

Name: verbb/comments
Purl: pkg:composer/verbb/comments

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.5

Affected versions

0.*

0.3.6

0.3.8

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.6.1

1.0.6.2

1.0.6.3

1.0.7

1.0.7.1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.7.1

1.1.8

1.1.9

1.1.10

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.3.11

1.3.12

1.4.0

1.4.1

1.4.1.1

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4