PT-2023-12192 · Izimodal · Izimodal

Erik Krogh Kristensen + 1 · Publicado 2023-02-20 · Atualizado 2023-03-02 · CVE-2021-32860

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iziModal versions prior to 1.6.1

Description The issue arises when handling untrusted modal titles, allowing an attacker to influence the title field and supply arbitrary html or javascript code. This code will be rendered in the context of a user, potentially leading to cross-site scripting (XSS).

Recommendations For versions prior to 1.6.1, update to version 1.6.1 to resolve the issue. As a temporary workaround, consider restricting the ability to influence the title field when creating an iziModal instance to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-32860

GHSA-H685-83W4-3PH3

Produtos afetados

Izimodal

Referências · 8

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-1044_iziModal · Exploit
• https://github.com/marcelodolza/iziModal · Nota
• https://github.com/marcelodolza/iziModal/issues/249 · Nota
• https://github.com/marcelodolza/iziModal/commit/01728ac52bac5c1b4512087dafe0ad8b091fdc9e · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2021-32860 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-32860 · Aviso do Fabricante
• https://t.me/cibsecurity/58616 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-h685-83w4-3ph3 · Aviso do Fabricante