CVE-2022-41905

Advisory

Wsgidav 4.1.0 includes a fix for CVE-2022-41905: Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled.
https://github.com/mar10/wsgidav/security/advisories/GHSA-xx6g-jj35-pxjv

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- 246 Add dir_browser/htdocs folder setup.cfg (for install with `pip install .`)
- 265 Fix PAM not threadsafe
- 268 Use relative paths to support reverse proxies
- Clarify how to use WsgiDAV behind a reverse proxy
- ``mount_path`` option is now validated (must be empty or start with a '/')
- Add `dir_browser.directory_slash` option to force trailing slashes (default: true).
Also use relative paths in directory listings in order to improve behavior
when running behind a reverse proxy.
- 183 Fix MOVE for reverse proxies (experimental)
- Resolve security advisory [CVE-2022-41905](https://github.com/mar10/wsgidav/security/advisories/GHSA-xx6g-jj35-pxjv)
Thanks brunnjf (Jon Brunn)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41905
• https://github.com/mar10/wsgidav/commit/e9606ab0f42f4c1a6611bc3c52de299b0aba7726
• https://github.com/mar10/wsgidav/security/advisories/GHSA-xx6g-jj35-pxjv