GitHub Advisoryadvisory · npm

GHSA-5xgh-643p-cp2g Cross-site Scripting in yapi-vendor

MEDIUM Published 2018-11-21 Modified 2022-09-21 Official page ↗

Aliases: CVE-2018-17574
Ecosystem: npm
Packages: yapi-vendor
Severity: Moderate
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2020-06-16

Affected packages

• npm yapi-vendor: < 1.3.23 → fixed in 1.3.23

Description

An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.

Related

Alias · CVE (1)

CVE-2018-17574 An issue was discovered in YMFE YApi 1.3.23. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2018-17574 advisory
https://github.com/YMFE/yapi/issues/520 web
https://github.com/YMFE/yapi package
https://github.com/advisories/GHSA-5xgh-643p-cp2g advisory