PT-2022-16863 · Sysend.Js · Sysend.Js

Jcubic · Published 2022-03-14 · Updated 2026-05-09 · CVE-2022-24762

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sysend.js versions prior to 1.10.0

Description The issue affects users who use cross-origin communication, potentially allowing their communications to be intercepted. However, the impact is limited because the communication occurs within the same browser. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider avoiding sending communications that a user does not want to have intercepted via sysend messages.

Exploit

Fix

Information Disclosure

Origin Validation Error

Weakness Enumeration

CWE-200

CWE-346

Related Identifiers

CVE-2022-24762

GHSA-4VVG-X86P-MVQC

Affected Products

Sysend.Js

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24762.json · Exploit
• 🔥 https://github.com/jcubic/sysend.js/issues/33 · Exploit
• https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a · Patch
• https://osv.dev/vulnerability/GHSA-4vvg-x86p-mvqc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24762 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24762 · Vendor Advisory
• https://github.com/jcubic/sysend.js/releases/tag/1.10.0 · Note
• https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc · Note
• https://github.com/jcubic/sysend.js · Note
• https://t.me/cvenotify/53593 · Telegram Post
• https://twitter.com/dailycve/status/2052953797635252684 · Twitter Post