PT-2019-12748 · Shave · Shave

Digitalcraft · Publicado 2019-05-24 · Atualizado 2019-05-29 · CVE-2019-12313

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shave versions prior to 2.5.3

Description The issue exists due to mishandled output encoding during the overwrite of an HTML element, which can lead to Cross-Site Scripting. If encoded HTML input is passed into the shave package, the output will be decoded, potentially resulting in Cross-Site Scripting.

Recommendations Upgrade to version 2.5.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12313

GHSA-GH4G-3GM9-5WRQ

Produtos afetados

Shave

Referências · 6

• https://github.com/dollarshaveclub/shave/commit/da7371b0531ba14eae48ef1bb1456a3de4cfa954#diff-074799b511e4b61923dfd3f2a3bf9b54R67 · Correção
• https://github.com/dollarshaveclub/shave/compare/852b537...da7371b · Correção
• https://osv.dev/vulnerability/GHSA-gh4g-3gm9-5wrq · Aviso do Fabricante
• https://npmjs.com/advisories/822 · Nota
• https://osv.dev/vulnerability/CVE-2019-12313 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12313 · Nota de Segurança