GHSA-g6f5-4w43-2x63

Source

https://github.com/advisories/GHSA-g6f5-4w43-2x63

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-g6f5-4w43-2x63/GHSA-g6f5-4w43-2x63.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g6f5-4w43-2x63

Published

2024-05-29T13:04:32Z

Modified

2024-12-04T05:38:25.141656Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

ScnSocialAuth Cross-site Scripting vulnerability in login redirect param

Details

ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700

Affected versions

All versions below 1.15.2 are affected. dev-master is fixed starting from https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700

Exploits

Because of missing escaping of the URL param redirect a XSS attack is possible. For example: Setting the redirect param to "><a%20href="http://github.com">GitHub.com</a><inpu%20type="hidden"%20" would result in a link added to the login page.

Resolution

If you are using any version of ScnSocialAuth below 1.15.2 please upgrade immediately by running composer update.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-29T13:04:32Z"
}

References

Affected packages

Packagist / socalnick/scn-social-auth

Package

Name: socalnick/scn-social-auth
Purl: pkg:composer/socalnick/scn-social-auth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.15.2

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.3.0

1.3.1

1.3.2

1.4.0

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.10.0

1.11.0

1.11.1

1.11.2

1.11.3

1.12.0

1.12.1

1.13.0

1.14.0

1.14.1

1.15.0-rc.1

1.15.0-rc.2

1.15.0

1.15.1