PT-2018-16191 · Npm · Metascrape

Published 2018-07-30 · Updated 2023-01-30 · CVE-2018-3773

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions metascraper versions prior to 5.2.0 metascrape npm module versions <= 3.9.2

Description The issue is related to a stored Cross-Site Scripting vulnerability in Open Graph meta properties. It affects the metascrape npm module and metascraper.

Recommendations For metascraper versions prior to 5.2.0, upgrade to version 5.2.0 or later. For metascrape npm module versions <= 3.9.2, upgrade to a version later than 3.9.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-3773

GHSA-8F64-Q7JC-CCGP

Affected Products

Metascrape

References · 7

• 🔥 https://hackerone.com/reports/309367 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3773 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3773 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f64-q7jc-ccgp · Vendor Advisory
• https://github.com/microlinkhq/metascraper/pull/169 · Note
• https://github.com/microlinkhq/metascraper · Note
• https://npmjs.com/advisories/603 · Note