Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code.
References
| Link | Resource |
|---|---|
| https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/ | Exploit Third Party Advisory |
| https://github.com/koush/scrypted/blob/71cbe83a2a20f743342df695ca7b98482b73e60f/server/src/plugin/plugin-http.ts#L45 | Product |
Configurations
History
13 Feb 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code. |
20 Dec 2023, 21:27
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:clockworkmod:scrypted:*:*:*:*:*:*:*:* | |
| First Time |
Clockworkmod scrypted
Clockworkmod |
19 Dec 2023, 15:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/ - Exploit, Third Party Advisory | |
| References | () https://github.com/koush/scrypted/blob/71cbe83a2a20f743342df695ca7b98482b73e60f/server/src/plugin/plugin-http.ts#L45 - Product | |
| CPE | cpe:2.3:a:koush:scrypted:*:*:*:*:*:*:*:* | |
| CWE | CWE-79 | |
| First Time |
Koush scrypted
Koush |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
13 Dec 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-13 22:15
Updated : 2024-02-13 01:15
NVD link : CVE-2023-47620
Mitre link : CVE-2023-47620
JSON object : View
Products Affected
clockworkmod
- scrypted
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')