Description
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| redaxo | core | < 5.21.0 | 5.21.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | redaxo/source | < 5.21.0 | 5.21.0 | GHSA-xq4j-g85q-wf97 |
References
- GitHub Security Advisory (GHSA-xq4j-g85q-wf97) vendor-advisory
- VulnCheck Advisory: REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter third-party-advisory