| Package | Affected versions | Patched versions |
|---|---|---|
| invenio-records | ≥ 1.1.0, < 1.1.1≥ 1.2.0, < 1.2.2< 1.0.2 | 1.1.11.2.21.0.2 |
| invenio-records | = 1.1.0= 1.2.0= 1.2.1≤ 1.0.1 |
A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.
All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free