MEDIUM5.4

GHSA-4hpr-hh77-6q9p

Cross site scripting in francoisjacquet/rosariosis

Quick fix

GHSA-4hpr-hh77-6q9p — francoisjacquet/rosariosis: upgrade to the fixed version with the command below.

composer require francoisjacquet/rosariosis:^9.1

Details

A Cross-site Scripting (XSS) vulnerability exists in in GitHub repository francoisjacquet/rosariosis prior to 9.1. HTML entities are not properly decoded from the URL.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/francoisjacquet/rosariosis

Introduced in: 0Fixed in: 9.1

Fixcomposer require francoisjacquet/rosariosis:^9.1

References

https://nvd.nist.gov/vuln/detail/CVE-2022-2036[ADVISORY]
https://github.com/francoisjacquet/rosariosis/commit/6e213b17e6ac3a3961e1eabcdaba1c892844398a[WEB]
https://github.com/francoisjacquet/rosariosis[PACKAGE]
https://huntr.dev/bounties/c7715149-f99c-4d62-a5c6-c78bfdb41905[WEB]