Description (CNA)
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| cube-root / directory-serve | affected 0 through 1.3.7 |
CWE
CWE-79
References
- https://github.com/cube-root/directory-serve
- https://github.com/cube-root/directory-serve/blob/main/lib/helper/html.js
ADP enrichment
No English description supplied.
No references supplied.