CVE-2023-3481 XSS in Chrome Lab Critters

2023-08-2110:04:23

CWE-116

CWE-80

Google

www.cve.org

cve-2023-3481

chrome lab critters

html parsing

cross-site scripting

upgrade

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

26.5%

JSON

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Critters",
    "vendor": "Google Chrome Labs",
    "versions": [
      {
        "lessThan": "0.0.19",
        "status": "affected",
        "version": "0.0.17",
        "versionType": "custom"
      }
    ]
  }
]