PT-2022-18221 · Unknown · Elements Plus!

Esonhugh · Published 2022-04-25 · Updated 2022-05-05 · CVE-2022-27103

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions element-plus versions prior to 2.0.5

Description The issue concerns Cross Site Scripting (XSS) via the el-table-column component. Specifically, when the show-tooltips-overflow attribute of el-table-column is set to true, a mouseover action can cause the text of this column to render as HTML, potentially leading to XSS.

Recommendations For element-plus versions prior to 2.0.5, consider disabling the show-tooltips-overflow attribute of el-table-column to minimize the risk of exploitation until a patch is available. Restrict access to the el-table-column component to prevent potential XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27103

GHSA-RJVG-8V36-XV9R

Affected Products

Elements Plus!

References · 10

• 🔥 https://github.com/element-plus/element-plus/issues/6514 · Exploit
• 🔥 https://github.com/asjdf/element-table-xss-test · Exploit
• https://osv.dev/vulnerability/CVE-2022-27103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27103 · Security Note
• https://osv.dev/vulnerability/GHSA-rjvg-8v36-xv9r · Vendor Advisory
• https://github.com/element-plus/element-plus · Note
• https://github.com/element-plus/element-plus/commit/063c56446135176971f532bd0eb2e88a0b137d43 · Note
• https://github.com/element-plus/element-plus/pull/6520 · Note
• https://github.com/asjdf/element-table-xss-test/issues/1 · Note
• https://t.me/cibsecurity/41376 · Telegram Post