GHSA-rmp7-f2vp-3rq4

Cross-site scripting in SiCKRAGE

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25925

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	sickrage	>= 4.2.0, < 10.0.11.dev2	10.0.11.dev2

Details

As written in the advisory (Markdown source, shown as plain text).

in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25925 advisory
https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4 web
https://github.com/SiCKRAGE/SiCKRAGE package
https://github.com/pypa/advisory-database/tree/main/vulns/sickrage/PYSEC-2021-147.yaml web
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25925 web