{"action":"Upgrade github.com/syncthing/syncthing to 1.23.5 or later.","affected":[{"fixed":"1.23.5","introduced":"0"}],"component":"github.com/syncthing/syncthing","cve_ids":["CVE-2022-46165"],"ecosystem":"Go","epss":0.00778,"exploited":false,"fixed_versions":["1.23.5"],"ghsa_id":"GHSA-9rp6-23gf-4c3h","id":"tcs_01M5KF656586TS6516ZCZJNGF9","modified_at":"2024-07-24T20:12:00.093170Z","published_at":"2023-06-06T16:39:57Z","references":["https://osv.dev/vulnerability/GHSA-9rp6-23gf-4c3h","https://github.com/syncthing/syncthing/security/advisories/GHSA-9rp6-23gf-4c3h","https://nvd.nist.gov/vuln/detail/CVE-2022-46165","https://github.com/syncthing/syncthing/commit/73c52eafb6566435dffd979c3c49562b6d5a4238","https://github.com/syncthing/syncthing/commit/f5e5af391a6583047c64ef8c51642003a79b75cf","https://github.com/syncthing/syncthing","https://github.com/syncthing/syncthing/releases/tag/v1.23.5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRYGBFJPVBW6PPTETNIBWQJE4HJSA5PJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEBWSQVGHSTR4ZO7LVVEMPEGMV2DS5XR"],"severity":{"label":"medium","score":4.6},"sources":[{"source":"osv","source_id":"GHSA-9rp6-23gf-4c3h","url":"https://osv.dev/vulnerability/GHSA-9rp6-23gf-4c3h"}],"summary":"syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI"}