PT-2023-12192 · Izimodal · Izimodal

Erik Krogh Kristensen + 1 · Published 2023-02-20 · Updated 2023-03-02 · CVE-2021-32860

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iziModal versions prior to 1.6.1

Description The issue arises when handling untrusted modal titles, allowing an attacker to influence the title field and supply arbitrary html or javascript code. This code will be rendered in the context of a user, potentially leading to cross-site scripting (XSS).

Recommendations For versions prior to 1.6.1, update to version 1.6.1 to resolve the issue. As a temporary workaround, consider restricting the ability to influence the title field when creating an iziModal instance to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32860

GHSA-H685-83W4-3PH3

Affected Products

Izimodal

References · 8

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-1044_iziModal · Exploit
• https://github.com/marcelodolza/iziModal/commit/01728ac52bac5c1b4512087dafe0ad8b091fdc9e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32860 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h685-83w4-3ph3 · Vendor Advisory
• https://github.com/marcelodolza/iziModal · Note
• https://github.com/marcelodolza/iziModal/issues/249 · Note
• https://t.me/cibsecurity/58616 · Telegram Post