What is GHSA-j9wp-x5q5-xh2f?

GHSA-j9wp-x5q5-xh2f is a security advisory published by GitHub Security Advisories with Low severity. Funadmin Cross-site Scripting vulnerability

Which CVE IDs does GHSA-j9wp-x5q5-xh2f cover?

GHSA-j9wp-x5q5-xh2f covers the following CVE IDs: CVE-2024-48228. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j9wp-x5q5-xh2f?

GHSA-j9wp-x5q5-xh2f has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-j9wp-x5q5-xh2f?

GHSA-j9wp-x5q5-xh2f affects 1 product, including: composer/funadmin/funadmin:\u003c= 5.0.2.

GHSA-j9wp-x5q5-xh2fLowCVSS 6.1

Funadmin Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

October 26, 2024

Last Modified

October 28, 2024

🔗 CVE IDs covered (1)

CVE-2024-48228 →

📋 Description

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).

🎯 Affected products1

composer/funadmin/funadmin:<= 5.0.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-48228
https://github.com/funadmin/funadmin/issues/31
https://github.com/advisories/GHSA-j9wp-x5q5-xh2f