Vulnerability-Lookup

GHSA-8CPW-73F2-W58M

Vulnerability from github – Published: 2019-08-27 17:38 – Updated: 2021-08-17 22:13

Summary

Cross-Site Scripting in selectize-plugin-a11y

Details

Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 1.1.0 or later.

Severity ?

6.1 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "selectize-plugin-a11y"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-15482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-08-27T17:01:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Versions of `selectize-plugin-a11y ` prior to 1.1.0 are vulnerable to Cross-Site Scripting. The `accessibility.liveRegion.speak` function does not sanitize the `msg` variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim\u0027s browser.\n\n\n## Recommendation\n\nUpgrade to version 1.1.0 or later.",
  "id": "GHSA-8cpw-73f2-w58m",
  "modified": "2021-08-17T22:13:00Z",
  "published": "2019-08-27T17:38:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1145"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/selectize-plugin-a11y/v/1.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-Site Scripting in selectize-plugin-a11y"
}

CVE-2019-15482 (GCVE-0-2019-15482)

Vulnerability from cvelistv5 – Published: 2019-08-23 12:51 – Updated: 2024-08-05 00:49

Summary

selectize-plugin-a11y before 1.1.0 has XSS via the msg field.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.npmjs.com/package/selectize-plugin-a1…	x_refsource_MISC
	https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:49:13.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.npmjs.com/package/selectize-plugin-a11y/v/1.1.0"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "selectize-plugin-a11y before 1.1.0 has XSS via the msg field."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-23T12:51:09",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.npmjs.com/package/selectize-plugin-a11y/v/1.1.0"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-15482",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "selectize-plugin-a11y before 1.1.0 has XSS via the msg field."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.npmjs.com/package/selectize-plugin-a11y/v/1.1.0",
              "refsource": "MISC",
              "url": "https://www.npmjs.com/package/selectize-plugin-a11y/v/1.1.0"
            },
            {
              "name": "https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9",
              "refsource": "MISC",
              "url": "https://github.com/SLMNBJ/selectize-plugin-a11y/pull/9"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-15482",
    "datePublished": "2019-08-23T12:51:09",
    "dateReserved": "2019-08-22T00:00:00",
    "dateUpdated": "2024-08-05T00:49:13.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted