PT-2019-20024 · Bootbox · Bootbox

Publicado 2019-05-30 · Atualizado 2019-05-30

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions bootbox versions (affected versions not specified)

Description The issue concerns a lack of input sanitization in dialog boxes provided by the package, allowing attackers to inject HTML code and execute arbitrary JavaScript, thus facilitating Cross-Site Scripting attacks.

Recommendations For all affected versions, sanitize user input being passed to bootbox or consider using an alternative package.

XSS

Enumeração de Fraquezas

CWE-64

CWE-79

Identificadores relacionados

GHSA-87MG-H5R3-HW88

Produtos afetados

Bootbox

Referências · 5

• https://github.com/makeusabrew/bootbox · Nota
• https://github.com/makeusabrew/bootbox/issues/661 · Nota
• https://hackerone.com/reports/508446 · Nota
• https://osv.dev/vulnerability/GHSA-87mg-h5r3-hw88 · Aviso do Fabricante
• https://npmjs.com/advisories/882 · Nota