PT-2024-37862 · Vue · Vue

Muxi Lyu + 2 · Published 2024-07-23 · Updated 2024-10-04 · CVE-2024-6783

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vue versions 2.0 through 3.0

Description A vulnerability has been discovered that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code.

Recommendations For versions 2.0 through 3.0, update to a version where the vulnerability has been patched, as this issue has been resolved in Vue 3. As a temporary workaround, consider restricting the modification of the prototype chain for properties like Object.prototype.staticClass and Object.prototype.staticStyle until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-6783

GHSA-G3CH-RX76-35FX

Affected Products

Vue

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6783 · Security Note
• https://osv.dev/vulnerability/GHSA-g3ch-rx76-35fx · Vendor Advisory
• https://github.com/vuejs/vue · Note
• https://herodevs.com/vulnerability-directory/cve-2024-6783---vue-client-side-xss · Note
• https://t.me/cvedetector/1508 · Telegram Post
• https://github.com/advisories/GHSA-g3ch-rx76-35fx · Note
• https://twitter.com/itsnotkipruto/status/1842277309165805972 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2024-6783 · Note
• https://t.me/cvenotify/92840 · Telegram Post