CVE-2023-40024
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In ScanCode.io, the `/license/` endpoint does not properly validate and sanitize the detailed view key, which can lead to a potential cross-site scripting (XSS) vulnerability. Attackers can exploit this flaw to inject malicious scripts that will be executed in users' browsers.
Risk Assessment
This vulnerability may lead to unauthorized actions, session hijacking, or theft of sensitive information by attackers. Users visiting the compromised page could face serious security threats.
Recommendation
It is recommended to upgrade to version `32.5.2`, where the issue has been addressed. There are no known workarounds for this vulnerability.
Original NVD description (English source)
ScanCode.io is a server to script and automate software composition analysis pipelines. In the `/license/` endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist. Attackers can exploit this vulnerability to inject malicious scripts into the response generated by the `license_details_view` function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information. This issue has been addressed in release `32.5.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.