PT-2019-14211 · Selectize · Selectize-Plugin-A11Y

J1Mmie + 1 · Published 2019-08-23 · Updated 2019-08-27 · CVE-2019-15482

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions selectize-plugin-a11y versions prior to 1.1.0

Description The issue concerns a Cross-Site Scripting (XSS) problem. Specifically, the accessibility.liveRegion.speak function does not properly sanitize the msg variable before rendering it as HTML. If the msg variable is controlled by user input, it allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendations For versions prior to 1.1.0, upgrade to version 1.1.0 or later. As a temporary workaround, consider restricting user input for the msg variable to prevent potential exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15482

GHSA-8CPW-73F2-W58M

Affected Products

Selectize-Plugin-A11Y

References · 6

• https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-15482 · Security Note
• https://osv.dev/vulnerability/GHSA-8cpw-73f2-w58m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15482 · Vendor Advisory
• https://npmjs.com/package/selectize-plugin-a11y/v/1.1.0 · Note
• https://npmjs.com/advisories/1145 · Note