Lucene search

GitHub Advisory DatabaseGHSA-GF8J-V8X5-H9QP

HistoryJan 08, 2020 - 5:15 p.m.

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

2020-01-0817:15:37

CWE-79

GitHub Advisory Database

github.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.9%

JSON

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring.

Affected configurations

Vulners

Node

enshrinedsvg-sanitizeRange<0.12.0

VendorProductVersionCPE
enshrinedsvg-sanitize*cpe:2.3:a:enshrined:svg-sanitize:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
enshrined	svg-sanitize	*	cpe:2.3:a:enshrined:svg-sanitize::::::::

References

github.com/advisories/GHSA-gf8j-v8x5-h9qp

github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0

github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0

nvd.nist.gov/vuln/detail/CVE-2019-18857

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.9%

JSON

Related for GHSA-GF8J-V8X5-H9QP