PT-2017-6532 · Ember.Js · Ember.Js

Phillip Haines · Published 2017-09-20 · Updated 2018-08-28 · CVE-2015-1866

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ember.js versions 1.10.x through 1.10.0 Ember.js versions 1.11.x through 1.11.1

Description A cross-site scripting (XSS) issue exists.

Recommendations For Ember.js versions 1.10.x through 1.10.0, update to version 1.10.1. For Ember.js versions 1.11.x through 1.11.1, update to version 1.11.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1866

GHSA-MP78-R56V-45QC

Affected Products

Ember.Js

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2015-1866.yml · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/04/14/11 · Exploit
• https://emberjs.com/blog/2015/04/14/security-and-bugfix-releases-ember-1-10-1-1-11-2-1-11-3.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mp78-r56v-45qc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1866 · Security Note
• https://github.com/Acidburn0zzz/ember.js · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1866 · Note
• https://web.archive.org/web/20200228155301/http://securityfocus.com/bid/74185 · Note
• https://groups.google.com/forum/#!topic/ember-security/nbntfs2EbRU · Note
• http://securityfocus.com/bid/74185 · Note