Threats tagged 'ghsa-c2c3-mpf8-3933'

Glance versions from 0.7.9 up to but not including 0.8.8 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. When users click the widget title, the injected script executes, enabling attackers to read dashboard pages through same-origin requests and exfiltrate content. The vulnerability has a CVSS score of 4.7, indicating medium severity.