Skip to content
OpenAdvisories
Medium · 5.1 CVE-2024-47067 EUVD-2024-2996GHSA-8pph-gfhp-w226GO-2024-3190

Alist Contains a Reflected Cross-Site Scripting Vulnerability

Published Sep 30, 2024 · Updated Sep 30, 2024 · Assigned by GitHub_M

Vendor: alist-org Product: alist Package: github.com/alist-org/alist Package: github.com/alist-org/alist/v3 Ecosystem: Go

Description

AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.

Affected products

VendorProductAffectedFixed
alist-org alist < 3.29.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
SLES 15 SP5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 govulncheck-vulndb 0.0.20241104T154416-5.1 openSUSE-SU-2024:0350-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20241030T212825-1.1 openSUSE-SU-2024:14447-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
openSUSE Leap 15.5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/alist-org/alist all versions — GO-2024-3190
Go github.com/alist-org/alist/v3 < 3.29.0 3.29.0 GHSA-8pph-gfhp-w226

Advisories 3

References