PT-2019-17655 · Buttle · Buttle

Bl4De + 1 · Publicado 2019-04-03 · Atualizado 2019-10-09 · CVE-2019-5422

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions buttle version 0.2.0 buttle versions prior to a fixed version (no fixed version specified)

Description The issue allows execution of attacker-provided code in the victim's browser. This occurs when an attacker creates an arbitrary file on the server, exploiting the failure to sanitize filenames. This enables attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendations For buttle version 0.2.0, consider using an alternative package until a fix is made available. For buttle versions prior to a fixed version, consider using an alternative package until a fix is made available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-5422

GHSA-GM29-35C7-8CFW

Produtos afetados

Buttle

Referências · 8

• https://npmjs.com/advisories/667 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5422 · Nota de Segurança
• https://hackerone.com/reports/331110 · Nota
• https://osv.dev/vulnerability/GHSA-gm29-35c7-8cfw · Aviso do Fabricante
• https://hackerone.com/reports/331032 · Nota
• https://npmjs.com/advisories/1009 · Nota
• https://osv.dev/vulnerability/CVE-2019-5422 · Aviso do Fabricante
• https://github.com/advisories/GHSA-gm29-35c7-8cfw · Nota