PT-2020-7563 · Facebook · React

Published 2020-09-04 · Updated 2020-09-04 · CVE-2013-7035

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: react versions 0.4.x through 0.4.1 react versions 0.5.x through 0.5.1

Description: The issue is related to Cross-Site Scripting (XSS) due to the failure to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.

Recommendations: If you are using react 0.4.x, upgrade to version 0.4.2 or later. If you are using react 0.5.x, upgrade to version 0.5.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-7035

GHSA-G53W-52XC-2J85

Affected Products

React

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-7035 · Security Note
• https://osv.dev/vulnerability/GHSA-g53w-52xc-2j85 · Vendor Advisory
• https://github.com/facebook/react · Note
• https://github.com/facebook/react/commit/94a9a3e752fe089ab23f3a90c26d20d46d62ab10 · Note
• https://github.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64 · Note
• https://snyk.io/vuln/npm:react:20131217 · Note
• https://reactjs.org/blog/2013/12/18/react-v0.5.2-v0.4.2.html · Note