PT-2017-6396 · Validator+1 · Validator+1
Published
2016-02-10
·
Updated
2018-11-06
·
CVE-2014-9772
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
validator versions prior to 2.0.0
Description
The issue allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters. This may result in a cross-site scripting vulnerability. The xss() function removes the word "javascript" when contained inside an attribute, but it does not properly handle cases where characters have been hex-encoded. For example, the input
<a href="javascript:...">abc</a> will render as <a href="javascript:...">abc</a>, which the browser will accept as valid JavaScript.Recommendations
For versions prior to 2.0.0, consider using an alternative package that provides similar xss filter functionality to mitigate this issue. If the xss filter feature is not currently being used, you are not affected by the vulnerability. However, if it is being used, updating to the latest version of the module will break your application. As a temporary workaround, consider disabling the
xss() function until a suitable replacement or patch is available.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Validator