Lucene search

[email protected]CVE-2019-16772

HistoryDec 07, 2019 - 12:15 a.m.

CVE-2019-16772

2019-12-0700:15:11

CWE-79

[email protected]

web.nvd.nist.gov

206

serialize-to-js

npm package

vulnerability

cross-site scripting

xss

node.js

regular expressions

node.js environment

serialized data

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

29.3%

JSON

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js’s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Affected configurations

Vulners

NVD

Node

commentholserialize_to_jsRange<3.0.1

CPENameOperatorVersion
serialize-to-js_project:serialize-to-jsserialize-to-js project serialize-to-jslt3.0.1

CPE	Name	Operator	Version
serialize-to-js_project:serialize-to-js	serialize-to-js project serialize-to-js	lt	3.0.1

CNA Affected

[
  {
    "product": "serialize-to-js",
    "vendor": "commenthol",
    "versions": [
      {
        "lessThan": "3.0.1",
        "status": "affected",
        "version": "< 3.0.1",
        "versionType": "custom"
      }
    ]
  }
]