CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through <= 2.4.1.
Explanation of Vulnerability in Simple Terms
Garden Gnome Package versions up to 2.4.1 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. An attacker with high-level privileges can craft a request that, when a user visits a page, executes arbitrary JavaScript in their browser. The vulnerability requires user interaction and affects the integrity and confidentiality of site data.
What an attacker can do
Inject and execute malicious JavaScript in users' browsers to steal data or perform actions on their behalf.
Potential impact on your site
Administrators with high privileges could be tricked into visiting a malicious link, allowing attackers to compromise site data or user accounts.
Conditions required to exploit
Attacker must have high-level administrative privileges and the victim must visit a crafted page or link.
Key dates
External resources
Related vulnerabilities
