« Volver al listado

CVE-2026-35403

Estado: AnalizadaMedia (5.4)—

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link. This vulnerability is fixed in 27.0.3 and 28.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcgill — Loris

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-35403",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-35403",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-10T20:42:22.792284Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "aces",
          "product": "Loris",
          "versions": [
            {
              "status": "affected",
              "version": ">= 15.10, < 27.0.3"
            },
            {
              "status": "affected",
              "version": ">= 28.0.0, < 28.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-08T19:25:23.893",
  "references": [
    {
      "url": "https://github.com/aces/Loris/security/advisories/GHSA-776p-5pwh-vc8p",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link. This vulnerability is fixed in 27.0.3 and 28.0.1."
    },
    {
      "lang": "es",
      "value": "LORIS (Longitudinal Online Research and Imaging System) es una aplicación web autoalojada que proporciona gestión de datos y proyectos para la investigación en neuroimagen. Desde la versión 15.10 hasta antes de la 27.0.3 y la 28.0.1, existe un potencial de ataque de cross-site scripting en el módulo survey_accounts si un usuario proporciona una etiqueta de visita no válida. Aunque los datos están correctamente codificados en JSON, el encabezado Content-Type no está configurado, lo que provoca que el navegador web interprete la carga útil como HTML, abriendo la posibilidad de un cross-site scripting si un usuario es engañado para seguir un enlace no válido. Esta vulnerabilidad se corrige en las versiones 27.0.3 y 28.0.1."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AEE921E-77AD-44F9-AC03-DCD447CF3897",
              "versionEndIncluding": "27.0.2",
              "versionStartIncluding": "15.10"
            },
            {
              "criteria": "cpe:2.3:a:mcgill:loris:28.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D358B66A-04AC-44F2-8EF6-4332D8AC00F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}