GHSA-v86m-j5f7-ccwh

GHSA-v86m-j5f7-ccwh · Passbolt Api E-mail HTML injection

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description. Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail. An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent. This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.

CVSS 4.4 · Media · Corrección disponible

Publicación

2024-05-20T16:51:20Z

Actualización

2024-12-05T05:46:14.632531Z

Pila tecnológica: php

Comprueba tu servidor →