{"id":"GHSA-98pf-gfh3-x3mp","aliases":[],"url":"https://o3.security/vulnerability/GHSA-98pf-gfh3-x3mp","summary":"Read the Docs vulnerable to Cross-Site Scripting (XSS)","details":"### Impact\n\nThis vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project. \n\nExploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like `hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/`.\n\n### Patches\n\nThis issue has been patched in our 8.8.1 release.","published":"2022-11-10T16:02:51Z","modified":"2022-11-10T16:02:51Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"readthedocs","fixedVersion":"8.8.1"}],"fix":{"url":"https://github.com/readthedocs/readthedocs.org/commit/b0ae626acd13882170ec5888e35f3ef2e48e6ff6","label":"readthedocs/readthedocs.org@b0ae626"},"references":[{"type":"WEB","url":"https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-98pf-gfh3-x3mp"},{"type":"WEB","url":"https://github.com/readthedocs/readthedocs.org/commit/b0ae626acd13882170ec5888e35f3ef2e48e6ff6"},{"type":"PACKAGE","url":"https://github.com/readthedocs/readthedocs.org"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2022-11-10T16:02:51Z"}}