GHSA-rh4r-f7f7-r99m

Source

https://github.com/advisories/GHSA-rh4r-f7f7-r99m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-rh4r-f7f7-r99m/GHSA-rh4r-f7f7-r99m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rh4r-f7f7-r99m

Aliases

CVE-2024-29193
GO-2024-3053

Published

2024-08-05T21:29:25Z

Modified

2024-08-06T23:12:04.912115Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

gotortc Cross-site Scripting vulnerability

Details

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (index.html) shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item (name) gets appended using innerHTML. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc’s origin.

Database specific

{
    "nvd_published_at": "2024-04-04T19:15:08Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-05T21:29:25Z"
}

References

Affected packages

Go / github.com/AlexxIT/go2rtc

Package

Name: github.com/AlexxIT/go2rtc; View open source insights on deps.dev
Purl: pkg:golang/github.com/AlexxIT/go2rtc

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.0