Description
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
zofe rapyd-admin
Default version status: unaffected
9.4.0 to < 9.20.0affected9.20.0unaffected
pkg:composer/zofe/rapyd-adminReferences
- https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a ↗
- https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0 ↗
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/select-list.blade.php#L108 ↗
- https://github.com/zofe/rapyd-admin ↗
- https://www.vulncheck.com/advisories/rapyd-admin-9.4.0-before-9.20.0-stored-xss-via-select-list-component ↗