Withdrawn Advisory

This advisory has been withdrawn because the user must configure jsdom to allow access to local files.

Original Description

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.4.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "jsdom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-20066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1220"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-22T18:50:49Z",
    "nvd_published_at": "2021-02-16T20:15:00Z",
    "severity": "LOW"
  },
  "details": "# Withdrawn Advisory\n\nThis advisory has been withdrawn because the user must configure jsdom to allow access to local files.\n\n# Original Description\n\nJSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.",
  "id": "GHSA-f4c9-cqv8-9v98",
  "modified": "2024-07-19T18:34:30Z",
  "published": "2022-05-24T17:42:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsdom/jsdom/issues/3124"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jsdom/jsdom"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-JSDOM-1075447"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2021-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom",
  "withdrawn": "2024-07-19T18:34:30Z"
}

cve-2021-20066

Vulnerability from cvelistv5

Published

2021-02-16 19:48

Modified

2024-08-03 17:30

Severity ?

Summary

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.

References

▼	URL	Tags
	https://www.tenable.com/security/research/tra-2021-05	x_refsource_MISC
	https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	JSDom

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/research/tra-2021-05"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "JSDom",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "JSDom 16.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-29T08:45:45",
        "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
        "shortName": "tenable"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tenable.com/security/research/tra-2021-05"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnreport@tenable.com",
          "ID": "CVE-2021-20066",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "JSDom",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "JSDom 16.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tenable.com/security/research/tra-2021-05",
              "refsource": "MISC",
              "url": "https://www.tenable.com/security/research/tra-2021-05"
            },
            {
              "name": "https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951",
              "refsource": "MISC",
              "url": "https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
    "assignerShortName": "tenable",
    "cveId": "CVE-2021-20066",
    "datePublished": "2021-02-16T19:48:08",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:30:07.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-f4c9-cqv8-9v98

Vulnerability from github