PT-2024-40181 · Webpack · Webpack

Published 2024-09-19 · Updated 2024-09-19

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Webpack versions (affected versions not specified)

Description: A DOM Clobbering vulnerability was discovered in Webpack's AutoPublicPathRuntimeModule, which can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements are present. This issue can be exploited when the output.publicPath field in the configuration is not set or is set to auto. The vulnerability allows an attacker to inject malicious scripts, potentially leading to severe security risks. A real-world exploitation of this vulnerability was found in the Canvas LMS.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-84JW-G43V-8GJM

Affected Products

Webpack

References · 4

• https://osv.dev/vulnerability/GHSA-84jw-g43v-8gjm · Vendor Advisory
• https://github.com/web-infra-dev/rspack · Note
• https://github.com/web-infra-dev/rspack/security/advisories/GHSA-84jw-g43v-8gjm · Note
• https://github.com/web-infra-dev/rspack/commit/0303c68bd76da258c9fd483936d3a00b9761aad0 · Note