PT-2023-12182 · Unknown+1 · Jquery Minicolors+1

Erik Krogh Kristensen + 1 · Publicado 2023-02-20 · Atualizado 2024-02-29 · CVE-2021-32850

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jQuery MiniColors versions prior to 2.3.6

Description The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors.

Recommendations For versions prior to 2.3.6, update to version 2.3.6 to resolve the issue. As a temporary workaround, consider validating and sanitizing color names to prevent cross-site scripting attacks.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-32850

GHSA-CRH5-VV2V-C82Q

MGASA-2024-0052

Produtos afetados

Debian

Jquery Minicolors

Referências · 31

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin · Exploit
• https://github.com/claviska/jquery-minicolors · Nota
• https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3 · Correção
• https://github.com/claviska/jquery-minicolors/releases/tag/2.3.6 · Nota
• https://github.com/sympa-community/sympa/releases/tag/6.2.72 · Nota
• https://t.me/cvenotify/44690 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2021-32850 · Aviso do Fabricante
• https://t.me/cvenotify/52129 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-32850 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32850 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=32896 · Nota
• https://security-tracker.debian.org/tracker/source-package/jquery-minicolors · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2021-32850 · Aviso do Fabricante