Description
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MacWarrior clipbucket-v5
Default version status: unaffected
0 to ≤ 5.5.3-#206affected
pkg:github/MacWarrior/clipbucket-v5References
- https://hackmd.io/@leediay/BJR_lh2ifg ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/language_settings.php#L32-L37 ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/styles/cb_2014/layout/blocks/language_edit.html#L40 ↗
- https://github.com/MacWarrior/clipbucket-v5/commit/0c1b5878a6135950d8a516975c4585e3b7c8790d ↗
- https://github.com/MacWarrior/clipbucket-v5 ↗
- https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-206-reflected-xss-via-edit-language-in-language-settings-php ↗