Lucene search

GitHub_MCVE-2023-49293

HistoryDec 04, 2023 - 11:15 p.m.

CVE-2023-49293

2023-12-0423:15:27

CWE-79

GitHub_M

web.nvd.nist.gov

vite

website

frontend

framework

html

transformation

vulnerability

cve-2023-49293

security

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.0%

JSON

Vite is a website frontend framework. When Vite’s HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts (<script type="module">...</script>), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to server.transformIndexHtml. Only apps using appType: 'custom' and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren’t exposed to the attacker. This issue has been addressed in [email protected], [email protected], and [email protected]. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

vitejsviteRange4.4.0–4.4.11node.js

vitejsviteRange5.0.0–5.0.4node.js

vitejsviteMatch5.0.0-node.js

vitejsviteMatch5.0.0beta0node.js

vitejsviteMatch5.0.0beta1node.js

vitejsviteMatch5.0.0beta10node.js

vitejsviteMatch5.0.0beta11node.js

vitejsviteMatch5.0.0beta12node.js

vitejsviteMatch5.0.0beta13node.js

vitejsviteMatch5.0.0beta14node.js

vitejsviteMatch5.0.0beta15node.js

vitejsviteMatch5.0.0beta16node.js

vitejsviteMatch5.0.0beta17node.js

vitejsviteMatch5.0.0beta18node.js

vitejsviteMatch5.0.0beta19node.js

vitejsviteMatch5.0.0beta2node.js

vitejsviteMatch5.0.0beta20node.js

vitejsviteMatch5.0.0beta3node.js

vitejsviteMatch5.0.0beta4node.js

vitejsviteMatch5.0.0beta5node.js

vitejsviteMatch5.0.0beta6node.js

vitejsviteMatch5.0.0beta7node.js

vitejsviteMatch5.0.0beta8node.js

vitejsviteMatch5.0.0beta9node.js

VendorProductVersionCPE
vitejsvite*cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:-:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta0:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta1:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta10:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta11:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta12:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta13:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta14:*:*:*:node.js:*:*
vitejsvite5.0.0cpe:2.3:a:vitejs:vite:5.0.0:beta15:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
vitejs	vite	*	cpe:2.3:a:vitejs:vite::::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:-::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta0::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta1::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta10::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta11::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta12::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta13::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta14::::node.js::*
vitejs	vite	5.0.0	cpe:2.3:a:vitejs:vite:5.0.0:beta15::::node.js::*

Rows per page:

1-10 of 231

CNA Affected

[
  {
    "vendor": "vitejs",
    "product": "vite",
    "versions": [
      {
        "version": ">=4.4.0, < 4.4.12",
        "status": "affected"
      },
      {
        "version": "= 4.5.0",
        "status": "affected"
      },
      {
        "version": ">=5.0.0, < 5.0.5",
        "status": "affected"
      }
    ]
  }
]