CVE-2023-38758
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Cross Site Scripting vulnerability in wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function.
Risk Assessment
An attacker could exploit this vulnerability to take control of the application, potentially leading to unauthorized access to user data.
Recommendation
It is recommended to update to the latest version of wger Workout Manager and review the code to secure the add-ingredient function against XSS attacks.
Original NVD description (English source)
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.