GitHub Advisoryadvisory · npm

GHSA-6rjc-4pwr-3vp7 Cross-Site Scripting in iobroker.web

MEDIUM Published 2019-12-02 Modified 2021-08-19 Official page ↗
Aliases
CVE-2019-10771
Ecosystem
npm
Packages
iobroker.web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-12-02

Affected packages

• npm iobroker.web: < 2.4.10 → fixed in 2.4.10

Description

Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 2.4.10 or later.

Related

Alias · CVE (1)

  • CVE-2019-10771 Characters in the GET url path are not properly escaped and can be reflected in the server response. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References