{"id":"GHSA-894g-6j7q-2hx6","summary":"Flask-Admin Cross-site Scripting vulnerability","details":"helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.","aliases":["CVE-2018-16516","PYSEC-2018-54"],"modified":"2024-09-20T18:01:55.773268Z","published":"2018-12-19T19:23:52Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:24:59Z","nvd_published_at":null},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16516"},{"type":"WEB","url":"https://github.com/flask-admin/flask-admin/pull/1699"},{"type":"WEB","url":"https://github.com/flask-admin/flask-admin/commit/8af10e0b022464fdcb2da3d0ea5bbd2f11c0acd1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-894g-6j7q-2hx6"},{"type":"PACKAGE","url":"https://github.com/flask-admin/flask-admin"},{"type":"WEB","url":"https://github.com/flask-admin/flask-admin/releases/tag/v1.5.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-admin/PYSEC-2018-54.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIYCWIH3BRLI2QNC53CQXLKVP27X7EH"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZU2VKULURVXEU4YFTLMBQGYMPSXQ4MBN"}],"affected":[{"package":{"name":"flask-admin","ecosystem":"PyPI","purl":"pkg:pypi/flask-admin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3"}]}],"versions":["0.1","0.1.1","0.1.2","0.1.3","0.1.4","0.2.0","0.2.1","0.2.2","0.3.0","0.4.0","0.4.1","0.4.2","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.2.0","1.3.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-894g-6j7q-2hx6/GHSA-894g-6j7q-2hx6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}