PT-2020-21336 · Blingjs · Blingjs

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions blingjs version 0.0.4

Description The issue concerns malicious code in version 0.0.4 of blingjs that, when executed in a browser, can extract sensitive information from form fields, including password, cvc, and cardnumber, and send this data to the endpoint "https://js-metrics.com/minjs.php?pl=". This could potentially lead to user data compromise.

Recommendations Replace version 0.0.4 of the blingjs module with a version before or after 0.0.4. Evaluate your application to determine whether user data was compromised due to the presence of the malicious code in version 0.0.4.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-HFC6-79WV-5HPW

Affected Products

Blingjs

References · 4

• https://osv.dev/vulnerability/GHSA-hfc6-79wv-5hpw · Vendor Advisory
• ❌ https://github.com/jamiller619/blingjs · Note, Deleted
• https://npmjs.com/advisories/619 · Note
• https://snyk.io/vuln/SNYK-JS-BLINGJS-451007 · Note