Description
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webasyst Webasyst Framework
Default version status: unaffected
0 to ≤ 4.4.0affected
pkg:composer/webasyst/frameworkReferences
- https://github.com/webasyst/webasyst-framework/issues/395 ↗
- https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/templates/actions/dialog/DialogAlbumSettings.html#L36 ↗
- https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/actions/album/photosAlbumSave.controller.php#L107 ↗
- https://github.com/webasyst/webasyst-framework ↗
- https://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-stored-xss-via-photos-album-url ↗