MEDIUM4.3

GHSA-2pg6-vw9c-qhjv

Passbolt API allows HTML injection

Quick fix

GHSA-2pg6-vw9c-qhjv — passbolt/passbolt_api: upgrade to the fixed version with the command below.

composer require passbolt/passbolt_api:^4.6.2

Details

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/passbolt/passbolt_api

Introduced in: 0Fixed in: 4.6.2

Fixcomposer require passbolt/passbolt_api:^4.6.2

References

https://nvd.nist.gov/vuln/detail/CVE-2024-33670[ADVISORY]
https://github.com/passbolt/passbolt_api/commit/5c537849040990086dcd5013b5bb009e1dad3fb6[WEB]
https://help.passbolt.com/incidents/reflective-html-injection-vulnerability[WEB]