1id: CVE-2024-34061
2info:
3  name: Changedetection.io <=v0.45.21 - Cross-Site Scripting
4  author: ritikchaddha
5  severity: medium
6  description: |
7    Changedetection.io is a free open source web page change detection,
8    website watcher, restock monitor and notification service.
9    In affected versions Input in parameter notification_urls is not processed
10    resulting in javascript execution in the application. A reflected XSS
11    vulnerability happens when the user input from
12    a URL or POST data is reflected on the page without being stored, thus allowing
13    the attacker to inject malicious content.
14    This issue has been addressed in version 0.45.22. Users are advised to upgrade.
15    There are no known workarounds for this vulnerability.
16  reference:
17    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67
18    - https://nvd.nist.gov/vuln/detail/CVE-2024-34061
19  classification:
20    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
21    cvss-score: 4.3
22    cve-id: CVE-2024-34061
23    cwe-id: CWE-79