Impact

A reflected cross-site scripting attack allowed an attacker to get a user's browser to inject malicious javascript code into the Bodhi page.

Patches

Versions 5.6.1 and up contain patches.

For more information

If you have any questions or comments about this advisory:

• Open an issue in bodhi

Reported by

We would like to thank @hexdefined for the report of this vulnerability.