CVE-2024-22048

medium

Description

govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.

References

https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773

https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773

https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1

https://github.com/alphagov/tech-docs-gem/pull/323

https://github.com/advisories/GHSA-x2xw-hw8g-6773

Details

Source: Mitre, NVD

Published: 2024-01-04

Updated: 2024-01-11

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N