PT-2020-20965 · Unknown · Another-Date-Picker

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions another-date-picker version 2.0.43

Description The issue concerns malicious code in version 2.0.43 of the another-date-picker module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted values to the endpoint "https://js-metrics.com/minjs.php?pl=".

Recommendations Replace version 2.0.43 of the another-date-picker module with a version before or after 2.0.43. Additionally, evaluate your application to determine if user data was compromised.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-2P62-C4RM-MR72

Affected Products

Another-Date-Picker

References · 5

• https://osv.dev/vulnerability/GHSA-2p62-c4rm-mr72 · Vendor Advisory
• https://npmjs.com/advisories/616 · Note
• ❌ https://github.com/bi-a/mydatepicker · Note, Deleted
• ❌ https://github.com/kekeh/mydatepicker · Note, Deleted
• https://snyk.io/vuln/SNYK-JS-ANOTHERDATEPICKER-451013 · Note