CVE-2021-32860 iziModal vulnerable to Cross-site Scripting

2023-02-2000:00:00

CWE-79

GitHub_M

www.cve.org

izimodal cross-site scripting xss jquery 1.6.1 patch vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

30.6%

JSON

iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field title when creating a iziModal instance is able to supply arbitrary html or javascript code that will be rendered in the context of a user, potentially leading to XSS. Version 1.6.1 contains a patch for this issue

CNA Affected

[
  {
    "vendor": "npm",
    "product": "iziModal",
    "versions": [
      {
        "version": "1.6.1",
        "status": "affected",
        "lessThan": "1.6.1",
        "versionType": "custom"
      }
    ]
  }
]