Badaso vulnerable to cross-site scripting

Impact

Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Original source description

References

• Security advisory nvd.nist.gov/vuln/detail/CVE-2023-38970
• Source reference github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md
• Source reference github.com/uasoft-indonesia/badaso
• Security advisory panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-new-member