id: PYSEC-2023-10
details: Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site
  scripting (XSS) vulnerability in the main page. This vulnerability allows attackers
  to execute arbitrary web scripts or HTML via a crafted payload injected into the
  URL parameter under the "Add a new change detection watch" function.
affected:
- package:
    name: changedetection-io
    ecosystem: PyPI
    purl: pkg:pypi/changedetection-io
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.40.1.1
  versions:
  - 0.38.2
  - "0.39"
  - 0.39.1
  - 0.39.10
  - 0.39.10.post1
  - 0.39.10.post2
  - 0.39.11
  - 0.39.12
  - 0.39.13
  - 0.39.13.1
  - 0.39.14
  - 0.39.14.1
  - 0.39.15
  - 0.39.16
  - 0.39.17
  - 0.39.17.1
  - 0.39.17.2
  - 0.39.18
  - 0.39.19
  - 0.39.19.1
  - 0.39.2
  - 0.39.20
  - 0.39.20.1
  - 0.39.20.2
  - 0.39.20.3
  - 0.39.20.4
  - 0.39.21
  - 0.39.21.1
  - 0.39.22
  - 0.39.22.1
  - 0.39.3
  - 0.39.4
  - 0.39.5
  - 0.39.6
  - 0.39.7
  - 0.39.8
  - 0.39.9
  - 0.40.0
  - 0.40.0.1
  - 0.40.0.2
  - 0.40.0.3
  - 0.40.0.4
  - 0.40.1.0
references:
- type: EVIDENCE
  url: https://github.com/dgtlmoon/changedetection.io/issues/1358
- type: ADVISORY
  url: https://github.com/dgtlmoon/changedetection.io/issues/1358
- type: EVIDENCE
  url: https://www.youtube.com/watch?v=TRTpRlkU3Hc
- type: ADVISORY
  url: https://github.com/advisories/GHSA-68wj-c2jw-5pp9
aliases:
- CVE-2023-24769
- GHSA-68wj-c2jw-5pp9
modified: "2023-05-04T03:49:45.088821Z"
published: "2023-02-17T22:15:00Z"