PT-2017-6396 · Validator+1 · Validator+1
Publicado
2016-02-10
·
Atualizado
2018-11-06
·
CVE-2014-9772
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
validator versions prior to 2.0.0
Description
The issue allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters. This may result in a cross-site scripting vulnerability. The xss() function removes the word "javascript" when contained inside an attribute, but it does not properly handle cases where characters have been hex-encoded. For example, the input
<a href="javascript:...">abc</a> will render as <a href="javascript:...">abc</a>, which the browser will accept as valid JavaScript.Recommendations
For versions prior to 2.0.0, consider using an alternative package that provides similar xss filter functionality to mitigate this issue. If the xss filter feature is not currently being used, you are not affected by the vulnerability. However, if it is being used, updating to the latest version of the module will break your application. As a temporary workaround, consider disabling the
xss() function until a suitable replacement or patch is available.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Validator