GitHub Advisoryadvisory · npm

GHSA-4vvg-x86p-mvqc Leaking of user information on Cross-Domain communication in sysend

MEDIUM Published 2022-03-14 Modified 2022-03-28 Official page ↗
Aliases
CVE-2022-24762
Ecosystem
npm
Packages
sysend
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-346
Reviewed
2022-03-14

Affected packages

• npm sysend: < 1.10.0 → fixed in 1.10.0

Description

Impact Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted. This is not a big impact because it happens only on the same browser. Patches It has been patched in version 1.10.0 Workarounds The only workaround is to not send sensitive information with sysend messages.

Related

Alias · CVE (1)

  • CVE-2022-24762 sysend.js is a library that allows a user to send messages between pages that are open in the same browser. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-346 Origin Validation Error weakness

References