Description
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| org.opencrx | opencrx-core-config | 4.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.opencrx:opencrx-client | >= 4.0.0, < 5.2.0 | 5.2.0 | GHSA-rwh9-8xx8-4wfm |
| Maven | org.opencrx:opencrx-core | >= 4.0.0, < 5.2.0 | 5.2.0 | GHSA-rwh9-8xx8-4wfm |
| Maven | org.opencrx:opencrx-core-config | >= 4.0.0, < 5.2.0 | 5.2.0 | GHSA-rwh9-8xx8-4wfm |
| Maven | org.opencrx:opencrx-core-models | >= 4.0.0, < 5.2.0 | 5.2.0 | GHSA-rwh9-8xx8-4wfm |
| Maven | org.opencrx:opencrx-gradle | >= 4.0.0, < 5.2.0 | 5.2.0 | GHSA-rwh9-8xx8-4wfm |