GHSA-qqv6-5w6p-3pgr

Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-20594

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.hswebframework.web:hsweb-commons	<= 3.0.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20594 advisory
https://github.com/hs-web/hsweb-framework/issues/107 web
https://github.com/hs-web/hsweb-framework/commit/b72a2275ed21240296c6539bae1049c56abb542f web
https://github.com/advisories/GHSA-qqv6-5w6p-3pgr advisory
https://github.com/hs-web/hsweb-framework package