PT-2019-14211 · Selectize · Selectize-Plugin-A11Y

J1Mmie + 1 · Publicado 2019-08-23 · Atualizado 2019-08-27 · CVE-2019-15482

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions selectize-plugin-a11y versions prior to 1.1.0

Description The issue concerns a Cross-Site Scripting (XSS) problem. Specifically, the accessibility.liveRegion.speak function does not properly sanitize the msg variable before rendering it as HTML. If the msg variable is controlled by user input, it allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendations For versions prior to 1.1.0, upgrade to version 1.1.0 or later. As a temporary workaround, consider restricting user input for the msg variable to prevent potential exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-15482

GHSA-8CPW-73F2-W58M

Produtos afetados

Selectize-Plugin-A11Y

Referências · 6

• https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-15482 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8cpw-73f2-w58m · Aviso do Fabricante
• https://npmjs.com/package/selectize-plugin-a11y/v/1.1.0 · Nota
• https://npmjs.com/advisories/1145 · Nota
• https://osv.dev/vulnerability/CVE-2019-15482 · Aviso do Fabricante