PT-2019-12748 · Shave · Shave

Digitalcraft · Published 2019-05-24 · Updated 2019-05-29 · CVE-2019-12313

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shave versions prior to 2.5.3

Description The issue exists due to mishandled output encoding during the overwrite of an HTML element, which can lead to Cross-Site Scripting. If encoded HTML input is passed into the shave package, the output will be decoded, potentially resulting in Cross-Site Scripting.

Recommendations Upgrade to version 2.5.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12313

GHSA-GH4G-3GM9-5WRQ

Affected Products

Shave

References · 6

• https://github.com/dollarshaveclub/shave/commit/da7371b0531ba14eae48ef1bb1456a3de4cfa954#diff-074799b511e4b61923dfd3f2a3bf9b54R67 · Patch
• https://github.com/dollarshaveclub/shave/compare/852b537...da7371b · Patch
• https://osv.dev/vulnerability/GHSA-gh4g-3gm9-5wrq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12313 · Security Note
• https://npmjs.com/advisories/822 · Note