Description
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | sickrage | 9.3.54.dev1-10.0.11.dev1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | sickrage | >= 9.3.54, < 10.0.11.dev2 | 10.0.11.dev2 | GHSA-x823-j7c4-vpc5 |
| PyPI | sickrage | >= 9.3.55, < 10.0.12.dev1 | 10.0.12.dev1 | PYSEC-2021-148 |