CVE-2021-32859 Baremetrics date range picker vulnerable to Cross-site Scripting

2023-02-2000:00:00

CWE-79

GitHub_M

www.cve.org

baremetrics

date range picker

cross-site scripting

xss

untrusted placeholder

calendar instance

html

javascript

user context

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.5%

JSON

The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted placeholder entries. An attacker who is able to influence the field placeholder when creating a Calendar instance is able to supply arbitrary html or javascript that will be rendered in the context of a user leading to XSS. There are no known patches for this issue.

CNA Affected

[
  {
    "vendor": "Baremetrics",
    "product": "baremetrics-calendar",
    "versions": [
      {
        "version": "1.0.14",
        "status": "affected",
        "lessThanOrEqual": "1.0.14",
        "versionType": "custom"
      }
    ]
  }
]