PT-2019-9305 · Unknown+1 · Html-Pages

Tungpun · Publicado 2019-02-01 · Atualizado 2019-10-09 · CVE-2018-16481

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions html-page versions prior to 2.1.1 html-pages (affected versions not specified)

Description A Cross-Site Scripting (XSS) issue was discovered, allowing malicious JavaScript code to be executed in the user's browser due to the lack of sanitization of folder names and paths before rendering. This enables attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code.

Recommendations For html-page versions prior to 2.1.1, consider using an alternative package until a fix is made available. For html-pages, consider using an alternative package until a fix is made available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-64

CWE-79

Identificadores relacionados

CVE-2018-16481

GHSA-5P26-HW7F-3CPR

Produtos afetados

Html-Pages

Referências · 5

• 🔥 https://hackerone.com/reports/330356 · Exploit
• https://npmjs.com/advisories/1001 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16481 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5p26-hw7f-3cpr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16481 · Aviso do Fabricante