PT-2019-13374 · Nuxt · @Nuxt/Devalue+1

Publicado 2019-07-11 · Atualizado 2019-07-18 · CVE-2019-13506

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions @Nuxt/devalue versions prior to 1.2.3 Nuxt.js versions prior to 2.6.2

Description The issue is related to the mishandling of object keys, leading to Cross-Site Scripting (XSS). Insufficient input sanitization allows an attacker to inject arbitrary JavaScript code through object keys.

Recommendations For @Nuxt/devalue versions prior to 1.2.3, upgrade to version 1.2.3 or later. For Nuxt.js versions prior to 2.6.2, upgrade to version 2.6.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13506

GHSA-6677-83PP-F862

Produtos afetados

@Nuxt/Devalue

Nuxt.Js

Referências · 10

• https://github.com/nuxt/nuxt.js/releases/tag/v2.6.2 · Nota
• https://github.com/nuxt/nuxt.js/commit/0d5dfe71917191c5b07f373896311f2d8f6b75be · Correção
• https://github.com/nuxt/nuxt.js/compare/c0776eb...8d14cd4 · Nota
• https://github.com/Rich-Harris/devalue/issues/19 · Nota
• https://github.com/nuxt/devalue/pull/8 · Correção
• https://github.com/nuxt/devalue/releases/tag/v1.2.3 · Nota
• https://osv.dev/vulnerability/GHSA-6677-83pp-f862 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-13506 · Aviso do Fabricante
• https://npmjs.com/advisories/814 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13506 · Nota de Segurança