PT-2022-9421 · Npm+4 · @Braintree/Sanitize-Url+4

Bob Wombat Hogg · Published 2022-02-22 · Updated 2022-11-15 · CVE-2021-23648

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @braintree/sanitize-url versions prior to 6.0.0

Description The issue is related to Cross-site Scripting (XSS) due to improper sanitization in the sanitizeUrl function. This allows for potential XSS attacks.

Recommendations For versions prior to 6.0.0, update to version 6.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the sanitizeUrl function until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2022:7519

ALSA-2022:8057

CESA-2022_7519

CVE-2021-23648

GHSA-HQQ7-2Q2V-82XQ

RHSA-2022:7519

RHSA-2022:8057

RHSA-2022_7519

RHSA-2022_8057

RLSA-2022:7519

RLSA-2022:8057

SNYK-JS-BRAINTREESANITIZEURL-2339882

Affected Products

@Braintree/Sanitize-Url

Almalinux

Centos

Red Hat

Rocky Linux

References · 81

• 🔥 https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882 · Exploit
• https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183 · Patch
• https://github.com/braintree/sanitize-url/pull/40 · Patch
• https://ubuntu.com/security/CVE-2021-23648 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-8057.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:7519 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-23648 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23648 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-8057.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23648 · Security Note
• https://osv.dev/vulnerability/ALSA-2022:7519 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-7519.html · Vendor Advisory