Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Habitica |
|
No data.
No data.
References
History
Thu, 12 Dec 2024 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Dec 2024 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch. | |
| Title | GHSL-2024-109: Reflected XSS in /login in habitica | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-12-12T16:00:45.275Z
Reserved: 2024-11-19T20:08:14.482Z
Link: CVE-2024-53272
Vulnrichment
Updated: 2024-12-12T15:56:21.494Z
NVD
Status : Received
Published: 2024-12-12T02:15:28.670
Modified: 2024-12-12T02:15:28.670
Link: CVE-2024-53272
Redhat
No data.