Cross-Site Scripting Vulnerability in Spotify-for-Alfred by Citelao
CVE-2021-40927

6.1MEDIUM

Key Information:

Vendor

Alfred-spotify-mini-player

Status
Alfred Spotify Mini Player
Vendor
CVE Published:
1 October 2021

What is CVE-2021-40927?

This vulnerability in Spotify-for-Alfred's callback.php file allows remote attackers to execute arbitrary web scripts or inject HTML by manipulating the error parameter. Users of version 0.13.9 and below are particularly at risk, as this exploitation can compromise the security of web interactions and user data.

References

https://github.com/citelao/Spotify-for-Alfred/issues/137
x_refsource_MISC
https://github.com/citelao/Spotify-for-Alfred
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.