CVE-2024-36110CWE-79

Cross-site scripting in ansibleguy-webui

High · published May 28, 2024

CVSS v3.1
8.2
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-28T18:33Z
EPSS history
Timeline
  • 28 MAY 18:33Z
    Cross-site scripting in ansibleguy-webui
    cvelistv5