Description
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Remediation
References
https://github.com/NanoHttpd/nanohttpd
https://www.vdoo.com/advisories
Related Vulnerabilities
CVE-2020-7793 Vulnerability in npm package ua-parser-js
CVE-2023-43794 Vulnerability in npm package nocodb
CVE-2020-7625 Vulnerability in npm package op-browser
CVE-2021-32824 Vulnerability in maven package org.apache.dubbo:dubbo-common
CVE-2022-24913 Vulnerability in maven package com.fasterxml.util:java-merge-sort