CVE-2021-23447 Cross-site Scripting (XSS)

2021-10-0716:40:12

snyk

www.cve.org

cve-2021-23447

cross-site scripting

package teddy

type confusion vulnerability

input sanitization bypass

model content array

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

43.8%

JSON

This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

CNA Affected

[
  {
    "product": "teddy",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "0.5.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]