CVE-2019-15607

2020-01-2802:13:16

CWE-79

hackerone

www.cve.org

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.

CNA Affected

[
  {
    "product": "node-red",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "0.20.7 and earlier"
      }
    ]
  }
]

References

hackerone.com/reports/681986