This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Anchorr v1.4.1 has a Stored XSS flaw in the Jellyseerr user selector. π **Consequences**: Attackers can inject malicious scripts.β¦
π‘οΈ **Root Cause**: **CWE-80** (Improper Neutralization of Input During Web Page Generation). The flaw lies in how the **Jellyseerr user selector** handles and renders user input without proper sanitization.
Q3Who is affected? (Versions/Components)
π₯ **Affected**: **Anchorr** Discord Bot by **openVESSL**. Specifically versions **1.4.1 and earlier**. If you are running v1.4.1 or older, you are at risk.
Q4What can hackers do? (Privileges/Data)
π **Hacker Capabilities**: With Stored XSS, hackers can execute arbitrary JavaScript in victims' browsers.β¦
π **Exploitation Threshold**: **Medium**. Requires **PR:L** (Low Privileges) and **UI:R** (User Interaction). The attacker needs to trick a user into interacting with the malicious payload in the user selector.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π« **Public Exploit**: **No**. The `pocs` field is empty. While advisory links exist, there is no confirmed public Proof-of-Concept (PoC) or wild exploitation code available yet.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Inspect the **Jellyseerr user selector** feature in your Anchorr bot. Look for any input fields that render user names or IDs without escaping.β¦
β **Official Fix**: **Yes**. The vulnerability is fixed in **Anchorr v1.4.2**. Check the GitHub release notes for the patch details. Upgrade immediately to the latest version.
Q9What if no patch? (Workaround)
π **No Patch Workaround**: If you cannot upgrade, **disable** the Jellyseerr integration or restrict access to the user selector feature. Manually sanitize any user inputs if you have custom code access.β¦
β‘ **Urgency**: **HIGH**. CVSS Score indicates **High** impact (C:H, I:H, A:H). Since it leads to Account Takeover, prioritize patching to v1.4.2 immediately to prevent potential ATO incidents.