PT-2014-3450 · Ember.Js · Ember.Js

Hyder Ali · Publicado 2014-02-27 · Atualizado 2018-08-28 · CVE-2014-0046

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ember.js versions 1.2.x through 1.2.1 Ember.js versions 1.3.x through 1.3.1 Ember.js versions 1.4.x through 1.4.0-beta.5

Description A cross-site scripting (XSS) issue exists in the link-to helper of Ember.js. This allows remote attackers to inject arbitrary web script or HTML via the title attribute when the helper is used in non-block form.

Recommendations For Ember.js versions 1.2.x through 1.2.1, update to version 1.2.2 or later. For Ember.js versions 1.3.x through 1.3.1, update to version 1.3.2 or later. For Ember.js versions 1.4.x through 1.4.0-beta.5, update to version 1.4.0-beta.6 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-0046

GHSA-4Q53-FQHC-CR46

Produtos afetados

Ember.Js

Referências · 15

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2014-0046.yml · Exploit
• https://github.com/emberjs/ember.js/commit/ab3199e68e1d0fc3c8f7f453cd38c51fe02af90b · Nota
• https://github.com/emberjs/ember.js/commit/45ee8df2a0efc0afe233d6b9b17045782a2e6b2d · Nota
• https://github.com/emberjs/ember.js/commit/94b28b8773acf894c4d7d7fccf4411a706292436 · Nota
• https://github.com/emberjs/ember.js · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0046 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91242 · Nota
• https://groups.google.com/forum/#%21topic/ember-security/1h6FRgr8lXQ · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0046 · Nota
• http://secunia.com/advisories/56965 · Aviso do Fabricante
• http://emberjs.com/blog/2014/02/07/ember-security-releases.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/02/14/6 · Nota
• https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ · Nota
• https://osv.dev/vulnerability/GHSA-4q53-fqhc-cr46 · Aviso do Fabricante
• http://securityfocus.com/bid/65579 · Nota