Description
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | < 3.7.12 | 3.7.12 |
References
- GitHub Security Advisory (GHSA-m288-p6wr-m6gv) vendor-advisory
- VulnCheck Advisory: Zipline before 3.7.12 XSS via url parameter on login page third-party-advisory