GHSA-x823-j7c4-vpc5

Cross-site scripting in sickrage

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25926

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	sickrage	>= 9.3.54, < 10.0.11.dev2	10.0.11.dev2

Details

As written in the advisory (Markdown source, shown as plain text).

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25926 advisory
https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4 web
https://github.com/SiCKRAGE/SiCKRAGE package
https://github.com/pypa/advisory-database/tree/main/vulns/sickrage/PYSEC-2021-148.yaml web