PT-2023-31065 · Unknown · Domsanitizer

Rhukster · Publicado 2023-11-22 · Atualizado 2023-11-28 · CVE-2023-49146

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMSanitizer versions prior to 1.0.7

Description The issue arises from the mishandling of comments and the use of greedy regular expressions in SVG documents, leading to a potential XSS attack.

Recommendations For versions prior to 1.0.7, update to version 1.0.7 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-49146

GHSA-2GHM-R75J-PJX2

Produtos afetados

Domsanitizer

Referências · 6

• https://github.com/rhukster/dom-sanitizer · Nota
• https://github.com/rhukster/dom-sanitizer/compare/1.0.6...1.0.7 · Correção
• https://github.com/rhukster/dom-sanitizer/commit/c2a98f27ad742668b254282ccc5581871d0fb601 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-49146 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49146 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2ghm-r75j-pjx2 · Aviso do Fabricante