GitHub Advisoryadvisory · Packagist, npm

GHSA-mv4h-qm24-x4gh Converse.js Exposure of Sensitive Information

MEDIUM Published 2022-05-14 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-6591
Ecosystem
Packagist, npm
Packages
jcbrand/converse.js, converse.js
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-07-25

Affected packages

• Packagist jcbrand/converse.js: < 3.3.3 → fixed in 3.3.3 • npm converse.js: < 3.3.3 → fixed in 3.3.3

Description

Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that chatroom bookmarks are private, but the various interacting software components do not necessarily make that happen.

Related

Alias · CVE (1)

  • CVE-2018-6591 Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References