PT-2022-16818 · Amazon · @Awsui/Components-React

Fralongopublished · Published 2022-02-24 · Updated 2022-03-08 · CVE-2022-24709

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @awsui/components-react versions prior to 3.0.367

Description The issue concerns multiple components in the @awsui/components-react package that do not properly neutralize user input, potentially allowing for javascript injection. This could lead to cross-site scripting (XSS) in certain circumstances, as the components may render content without adequate neutralization.

Recommendations For versions prior to 3.0.367, upgrade to version 3.0.367 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable components until a patch is applied. There are no known workarounds for this issue other than upgrading to the fixed version.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24709

GHSA-MF22-92PM-M8P8

Affected Products

@Awsui/Components-React

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24709.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24709 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24709 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mf22-92pm-m8p8 · Vendor Advisory
• https://github.com/aws/awsui-documentation/security/advisories/GHSA-mf22-92pm-m8p8 · Note
• https://github.com/aws/awsui-documentation · Note
• https://npmjs.com/package/@awsui/components-react · Note
• https://npmjs.com/package/%40awsui/components-react · Note
• https://t.me/cvenotify/27305 · Telegram Post
• https://t.me/cibsecurity/38041 · Telegram Post