Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.
Metrics
Affected Vendors & Products
References
History
No history.

Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-12-06T00:33:43.731Z
Updated: 2024-08-03T14:24:03.382Z
Reserved: 2022-11-28T17:27:19.996Z
Link: CVE-2022-46151

No data.

Status : Modified
Published: 2022-12-06T01:15:09.813
Modified: 2024-11-21T07:30:12.687
Link: CVE-2022-46151

No data.