Vulnerability · Published Dec 14, 2021 · Assigned by GitHub_M

CVE-2021-39183Unsafe inline XSS Owncast

High 8.2

In plain English

A high-severity cross-site scripting in owncast from owncast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.8%top 44.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/owncast/owncast	0.0.9	GHSA-2hfj-cxw7-g45p
Go	github.com/owncast/owncast	0.0.9	GO-2022-0291

Affected products (as reported)

Vendor	Product	Versions
owncast	owncast	< 0.0.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

References

https://github.com/owncast/owncast/security/advisories/GHSA-2hfj-cxw7-g45p x_refsource_CONFIRM