Description (CNA)
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filter, that tells the engine to not escape the rendered content. This can lead to a stored XSS inside the content of the post. The code that causes the problem is in template/routes.html.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DogukanUrker / FlaskBlog | affected <= 2.8.0 |
CWE
CWE-79, CWE-807
References
ADP enrichment
No English description supplied.
No references supplied.