GitHub Advisoryadvisory · npm

GHSA-g9ph-r9hc-34r8 Erxes vulnerable to Cross-site Scripting

MEDIUM Published 2023-02-21 Modified 2023-02-22 Official page ↗
Aliases
CVE-2021-32853
Ecosystem
npm
Packages
erxes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-02-22

Affected packages

• npm erxes: <= 1.0.1 (no fix yet)

Description

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in all versions. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.

Related

Alias · CVE (1)

  • CVE-2021-32853 Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References