PT-2020-9729 · Node Red · Node-Red

Vineet Pandey + 1 · Published 2020-01-28 · Updated 2020-01-30 · CVE-2019-15607

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions node-red versions prior to 0.20.8

Description A stored XSS issue is present in the node-red npm package, a visual tool for wiring the Internet of Things. This allows attackers to steal session cookies and deface web applications by executing arbitrary JavaScript in the victim's browser. The issue arises from the failure to sanitize the name field in new Flows.

Recommendations Upgrade to version 0.20.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15607

GHSA-8W65-XJC5-9W79

Affected Products

Node-Red

References · 5

• 🔥 https://hackerone.com/reports/681986 · Exploit
• https://osv.dev/vulnerability/CVE-2019-15607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15607 · Security Note
• https://osv.dev/vulnerability/GHSA-8w65-xjc5-9w79 · Vendor Advisory
• https://npmjs.com/advisories/1456 · Note