Safety vulnerability ID: 62598
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Dpaste 3.8 includes a fix for CVE-2023-49277: A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. The patched version is on dpaste GH repository.
https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39
Latest version: 3.5
A Django based pastebin for text and code.
dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability. See CVE-2023-49277.
MISC:https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086: https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086
MISC:https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39: https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application