All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found.
References
Configurations
History
07 Jun 2023, 14:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Algernon Project
Algernon Project algernon |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:algernon_project:algernon:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L514 - Broken Link | |
| References | (MISC) https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONTHEMES-3312112 - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L512 - Broken Link | |
| References | (MISC) https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/themes/html.go%23L145 - Broken Link | |
| References | (MISC) https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONENGINE-3312111 - Exploit, Third Party Advisory | |
| CWE | CWE-79 |
31 May 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-31 05:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-26131
Mitre link : CVE-2023-26131
CVE.ORG link : CVE-2023-26131
JSON object : View
Products Affected
algernon_project
- algernon
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')