Executive Summary

This vulnerability is a stored Cross-site Scripting (XSS) issue in ClipBucket v5 versions 5.5.2-#146 and below. It occurs in the Manage Playlists feature, specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML or JavaScript code. This code is stored and then rendered unescaped on playlist detail and listing pages, causing arbitrary JavaScript to execute in the browsers of anyone viewing the playlist, including administrators.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with low privileges to execute arbitrary JavaScript code in the browsers of users who view the malicious playlist, including administrators. This can lead to session hijacking, theft of sensitive information, unauthorized actions performed on behalf of users, and potential compromise of the entire application or user accounts.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ClipBucket to version 5.5.2-#147 or later, where the stored Cross-site Scripting (XSS) vulnerability in the Manage Playlists feature is fixed. Additionally, restrict playlist creation permissions to trusted users and monitor for suspicious playlist names containing HTML or JavaScript code.

Useful 0 Not Useful 0