PT-2018-4726 · Npm · Reduce-Css-Calc

Chalker · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10548

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions reduce-css-calc versions <=1.2.4

Description Arbitrary code execution is possible through crafted CSS, making cross-site scripting (XSS) possible on the client and arbitrary code injection possible on the server. This occurs because user input is passed to the calc function, and affected versions of reduce-css-calc pass input directly to eval. If user input is passed into the calc function, this may result in cross-site scripting on the browser or remote code execution on the server.

Recommendations For versions <=1.2.4, update to version 1.2.5 or later. As a temporary workaround, consider restricting the use of the calc function to minimize the risk of exploitation. Avoid passing user input to the calc function until the issue is resolved.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2016-10548

GHSA-4662-J96G-MV46

Produtos afetados

Reduce-Css-Calc

Referências · 7

• 🔥 https://nodesecurity.io/advisories/144 · Exploit
• 🔥 https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10548 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10548 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4662-j96g-mv46 · Aviso do Fabricante
• https://github.com/advisories/GHSA-4662-j96g-mv46 · Nota
• https://npmjs.com/advisories/144 · Nota