CVE-2020-11944

Name of the Vulnerable Software and Affected Versions Abe (aka bitcoin-abe) versions 0.7.2 and earlier, 0.8pre

Description The issue allows for XSS in the call function within abe.py. This occurs because the PATH INFO environment variable is mishandled during a PageNotFound exception.

Recommendations For versions 0.7.2 and earlier, and 0.8pre, consider restricting access to the call function in abe.py until a proper fix is applied. As a temporary workaround, avoid using the PATH INFO environment variable in the affected PageNotFound exception handling until the issue is resolved.