Description (CNA)
GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in `v0.20.1`.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GZTimeWalker / GZCTF | affected < 0.20.1 |
CWE
CWE-80, CWE-79
References
- https://github.com/GZTimeWalker/GZCTF/security/advisories/GHSA-p6rq-5x3x-rmhh
- https://github.com/GZTimeWalker/GZCTF/commit/31e775b65cddf82a567d68dcdc78c1739b746346
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.