GHSA-5chx-gg25-v37m

Cross-site Scripting in xain

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-20302

Packages

Ecosystem	Package	Affected	Fixed in
Hex	xain	< 0.6.2	0.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

XSS is possible via the use of the order query parameter. An example request would look like: ``` http://host/ressources?order=%27><script>alert(1);</script> ```

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20302 advisory
https://github.com/smpallen99/xain/issues/18 web
https://github.com/dependabot/elixir-security-advisories/blob/master/packages/xain/2018-09-03.yml web
https://github.com/smpallen99/xain package