CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jandal Bitcoin Payments bitcoin-payments allows DOM-Based XSS.This issue affects Bitcoin Payments: from n/a through <= 1.4.2.
Explanation of Vulnerability in Simple Terms
Bitcoin Payments versions 1.4.2 and earlier contain a cross-site scripting vulnerability that allows an authenticated attacker to inject malicious scripts. The attacker must trick a user into visiting a crafted page. The injected script can access sensitive data, modify page content, or perform actions on behalf of the victim within the affected component and potentially beyond.
What an attacker can do
Inject malicious scripts that execute in a user's browser and access sensitive data or modify page content.
Potential impact on your site
Users' sessions and data could be compromised if they interact with pages containing injected malicious scripts.
Conditions required to exploit
Attacker must be authenticated with low privileges and the victim must visit a page containing the attacker's malicious input.
Key dates
External resources
Related vulnerabilities
