PT-2020-9582 · Amazon · Aws-Js-S3-Explorer

Zflamig · Published 2020-02-13 · Updated 2020-02-18 · CVE-2019-14652

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) versions prior to 2019-08-02

Description: The issue allows for cross-site scripting (XSS) under certain circumstances. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take control of the user's session.

Recommendations: For versions prior to 2019-08-02, update to a version released after 2019-08-02 to resolve the issue. As a temporary workaround, consider restricting access to the explorer.js file to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-14652

Affected Products

Aws-Js-S3-Explorer

References · 6

• https://github.com/awslabs/aws-js-s3-explorer/commit/87efa7d6885c4a9d8473ec5893adf8e4922a8a89 · Patch
• https://github.com/awslabs/aws-js-s3-explorer/commit/7be671e858601455d6969e445d21a911632d6c94 · Patch
• https://osv.dev/vulnerability/CVE-2019-14652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14652 · Security Note
• https://github.com/awslabs/aws-js-s3-explorer/pull/62 · Note
• https://t.me/cvenotify/987 · Telegram Post