GHSA-pmhg-f7wc-c97m

Suggest an improvement
Source
https://github.com/advisories/GHSA-pmhg-f7wc-c97m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-pmhg-f7wc-c97m/GHSA-pmhg-f7wc-c97m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pmhg-f7wc-c97m
Aliases
  • CVE-2024-8863
Published
2024-09-16T14:37:27Z
Modified
2024-09-20T20:12:31.799672Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Aim Stored XSS through TEXT EXPLORER
Details

A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbox.tsx of the component Text Explorer. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

PyPI / aim

Package

Name
aim
View open source insights on deps.dev
Purl
pkg:pypi/aim

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.24.0

Affected versions

2.*

2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0
3.1.1
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.6.0
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.8.0
3.8.1
3.9.0a1
3.9.0a14
3.9.2
3.9.3
3.9.4
3.10.0.dev9
3.10.0
3.10.1
3.10.2
3.10.3
3.11.0.dev4
3.11.0
3.11.1.dev1
3.11.1
3.11.2
3.12.0.dev2
3.12.0
3.12.1
3.12.2
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.1
3.15.2
3.16.0
3.16.1
3.16.2
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.17.5rc1
3.17.5rc2
3.17.5rc3
3.17.5rc4
3.17.5
3.18.0.dev2
3.18.0.dev3
3.18.0.dev4
3.18.0.dev5
3.18.0
3.18.1
3.19.0
3.19.1
3.19.2
3.19.3
3.20.1
3.21.0
3.22.0
3.23.0.dev20240622
3.23.0.dev20240624
3.23.0.dev20240626
3.23.0.dev20240627
3.23.0.dev20240628
3.23.0.dev20240629
3.23.0.dev20240630
3.23.0.dev20240701
3.23.0.dev20240702
3.23.0.dev20240703
3.23.0.dev20240704
3.23.0.dev20240705
3.23.0.dev20240706
3.23.0.dev20240707
3.23.0.dev20240708
3.23.0.dev20240712
3.23.0.dev20240713
3.23.0.dev20240714
3.23.0
3.24.0.dev20240715
3.24.0.dev20240716
3.24.0.dev20240717
3.24.0.dev20240718
3.24.0.dev20240719
3.24.0.dev20240720
3.24.0.dev20240721
3.24.0.dev20240722
3.24.0.dev20240723
3.24.0.dev20240724
3.24.0.dev20240725
3.24.0.dev20240726
3.24.0.dev20240727
3.24.0.dev20240728
3.24.0.dev20240729
3.24.0.dev20240730
3.24.0.dev20240731
3.24.0.dev20240801
3.24.0.dev20240802
3.24.0.dev20240803
3.24.0.dev20240804
3.24.0.dev20240805
3.24.0.dev20240806
3.24.0.dev20240807
3.24.0.dev20240808
3.24.0.dev20240809
3.24.0.dev20240810
3.24.0.dev20240811
3.24.0.dev20240812
3.24.0.dev20240813
3.24.0