CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rami Yushuvaev Pastebin pastebin-embed allows Stored XSS.This issue affects Pastebin: from n/a through <= 1.5.
Explanation of Vulnerability in Simple Terms
Pastebin versions 1.5 and earlier contain a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into the application. An authenticated user must visit a crafted link for the attack to succeed. The vulnerability can affect other users and compromise data confidentiality and integrity.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they visit a crafted link.
Potential impact on your site
User accounts and data could be compromised if users click attacker-controlled links while logged in.
Conditions required to exploit
Attacker must have a valid Pastebin account and trick a user into clicking a malicious link.
Key dates
External resources
Related vulnerabilities
