[FD] CVE-2019-8939: XSS in Tautulli

[Geeknik Labs via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

Tautulli (https://tautulli.com/) is a Python based monitoring and tracking tool 
for Plex Media Server.

We discovered that an authenticated Plex Media Server user could change their 
Plex username to include JavaScript and Tautulli would fail to sanitize the 
username so that when the Plex Media Server administrator viewed certain pages 
generated by Tautulli, the JavaScript would be executed in the context of the 
server administrator.

This was disclosed to the project's issue tracker on 19 February 2019 and was 
marked as fixed in the next release by the developer on 20 February 2019.

Initial Report: https://github.com/Tautulli/Tautulli-Issues/issues/161
Patch: 
https://github.com/Tautulli/Tautulli/commit/6a21d7690a40ea4678ad0908a6a1846c289cc943

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/