PYSEC-2021-148

    Dashboard / Vulnerabilities / PYSEC-2021-148

    PYSEC-2021-148

    Published: 12 Apr 2021Last Modified: 8 Nov 2023

    Summary:

    Details: In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.

    References: https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4, https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25926,, https://github.com/advisories/GHSA-x823-j7c4-vpc5

    Affected packages

    Package

    Name: sickrage

    Purl: pkg:pypi/sickrage

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9f42426727e16609ad3d1337f6637588b8ed28e4

    Affected versions

    10.0.0
    10.0.0.dev10
    10.0.0.dev11
    10.0.0.dev12
    10.0.0.dev13
    10.0.0.dev14
    10.0.0.dev15
    10.0.0.dev16
    10.0.0.dev17
    10.0.0.dev18
    10.0.0.dev19
    10.0.0.dev20
    10.0.0.dev21
    10.0.0.dev22
    10.0.0.dev23
    10.0.0.dev24
    10.0.0.dev25
    10.0.0.dev26
    10.0.0.dev27
    10.0.0.dev28
    10.0.0.dev29
    10.0.0.dev3
    10.0.0.dev30
    10.0.0.dev31
    10.0.0.dev33
    10.0.0.dev34
    10.0.0.dev35
    10.0.0.dev4
    10.0.0.dev5
    10.0.0.dev6
    10.0.0.dev7
    10.0.0.dev8
    10.0.0.dev9
    10.0.1
    10.0.1.dev1
    10.0.10
    10.0.10.dev1
    10.0.10.dev2
    10.0.11
    10.0.11.dev1
    10.0.11.dev2
    10.0.2
    10.0.2.dev1
    10.0.3
    10.0.3.dev1
    10.0.4
    10.0.4.dev1
    10.0.4.dev2
    10.0.4.dev3
    10.0.4.dev4
    10.0.5
    10.0.5.dev1
    10.0.6
    10.0.6.dev1
    10.0.7
    10.0.7.dev1
    10.0.7.dev2
    10.0.8
    10.0.8.dev1
    10.0.8.dev2
    10.0.8.dev3
    10.0.9
    10.0.9.dev2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2021-148 | CVE-DB