PT-2023-24603 · Jstachio · Jstachio

Casid · Publicado 2023-05-30 · Atualizado 2023-06-06 · CVE-2023-33962

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JStachio versions prior to 1.0.1

Description JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. This can be exploited to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine, leading to consequences such as session hijacking, defacement of web pages, theft of sensitive information, or propagation of malware.

Recommendations To mitigate this vulnerability, update to version 1.0.1 or later, which contains a patch for this issue. As a temporary workaround, consider using only double quotes " for HTML attributes to avoid the issue. To properly escape special characters, including single quotes, escape ' as &#39.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-33962

GHSA-GWXV-JV83-6QJR

Produtos afetados

Jstachio

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33962.json · Exploit
• 🔥 https://github.com/jstachio/jstachio/security/advisories/GHSA-gwxv-jv83-6qjr · Exploit
• https://github.com/jstachio/jstachio/issues/157 · Correção
• https://github.com/jstachio/jstachio/pull/158 · Correção
• https://github.com/jstachio/jstachio/commit/7b2f78377d1284df14c580be762a25af5f8dcd66 · Correção
• https://github.com/jstachio/jstachio · Nota
• https://github.com/jstachio/jstachio/releases/tag/v1.0.1 · Nota
• https://t.me/cibsecurity/64800 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33962 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gwxv-jv83-6qjr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-33962 · Aviso do Fabricante