MEDIUM5.4

GHSA-44cg-qcpr-fwjh

Cross site scripting in francoisjacquet/rosariosis

Quick fix

GHSA-44cg-qcpr-fwjh — francoisjacquet/rosariosis: upgrade to the fixed version with the command below.

composer require francoisjacquet/rosariosis:^7.6.1

Details

A Cross Site Scripting (XSS) vulnerabilty exits in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/francoisjacquet/rosariosis

Introduced in: 0Fixed in: 7.6.1

Fixcomposer require francoisjacquet/rosariosis:^7.6.1

References

https://nvd.nist.gov/vuln/detail/CVE-2021-44565[ADVISORY]
https://gitlab.com/francoisjacquet/rosariosis[PACKAGE]
https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761[WEB]
https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636[WEB]
https://gitlab.com/francoisjacquet/rosariosis/-/issues/307[WEB]