id: PYSEC-2023-143
modified: 2023-08-17T03:22:34.437974Z
published: 2023-08-08T16:15:00Z
aliases:
- CVE-2023-38758
- GHSA-8m9p-3926-gffr
details: Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3
  allows a remote attacker to gain privileges via the license_author field in the
  add-ingredient function in the templates/ingredients/view.html, models/ingredients.py,
  and views/ingredients.py components.
affected:
- package:
    ecosystem: PyPI
    name: wger
    purl: pkg:pypi/wger
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
  versions:
  - "1.1"
  - 1.1.1
  - "1.2"
  - 1.2rc1
  - "1.3"
  - "1.4"
  - "1.5"
  - "1.6"
  - 1.6.1
  - "1.7"
  - "1.8"
  - "1.9"
  - "2.0"
  - "2.1"
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
references:
- type: EVIDENCE
  url: https://github.com/0x72303074/CVE-Disclosures
- type: WEB
  url: https://github.com/0x72303074/CVE-Disclosures
- type: WEB
  url: https://wger.de
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8m9p-3926-gffr