CVE-2020-26280: OpenSlides Persistent Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2020-26280: OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. Affects openslides across 2 version ranges.
< 3.3
< f3809fc8a97ee305d721662a75f788f9e9d21938
Fixed in f3809fc8a97ee305d721662a75f788f9e9d21938. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. It allows users to enter rich text in various places, such as personal notes or motions. OpenSlides version 3.2 is vulnerable to a persistent cross-site scripting (XSS) attack due to insufficient user input validation and escaping.
Vulnerability Detail
The vulnerability in OpenSlides version 3.2 allows users to store arbitrary JavaScript code in fields where rich text can be entered. When other users read the respective text, the JavaScript code is executed, enabling an attacker to manipulate votes, hijack the moderator's session, or disrupt the meeting. The vulnerability was introduced on April 16, 2020, with commit 6eae497abeab234418dfbd9d299e831eff86ed45 and is fixed in version 3.3 with commit f3809fc8a97ee305d721662a75f788f9e9d21938.
How To Fix
Minimum fixed version
f3809fc8a97ee305d721662a75f788f9e9d21938
This is the first release that contains the fix.
pip install --upgrade "openslides==f3809fc8a97ee305d721662a75f788f9e9d21938"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
OpenSlides version 3.2 is vulnerable to a persistent cross-site scripting (XSS) attack. Users are advised to update to version 3.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openslides →
FAQ
OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies.
Persistent cross-site scripting (XSS) is a type of web vulnerability where malicious scripts are injected into a website and executed by other users who view the affected content.
An attacker can manipulate votes, hijack the moderator's session, or disrupt the meeting by injecting arbitrary JavaScript code into OpenSlides fields.
The vulnerability was introduced on April 16, 2020, with commit 6eae497abeab234418dfbd9d299e831eff86ed45.
To fix the vulnerability, update OpenSlides to version 3.3 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for openslides.
