Lucene search

GitHub Advisory DatabaseGHSA-2R57-2MRH-GGJV

HistoryJun 04, 2024 - 12:31 p.m.

ydata cross-site scripting

2024-06-0412:31:05

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

ydata

profiling

open-source

library

browser

vulnerability

malicious

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata’s ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser.

Affected configurations

Vulners

Node

ydataprofilingRange3.7.0≥

ydataprofilingRange≤4.8.3

CPENameOperatorVersion
ydata-profilingge3.7.0
ydata-profilingle4.8.3

CPE	Name	Operator	Version
	ydata-profiling	ge	3.7.0
	ydata-profiling	le	4.8.3

References

github.com/advisories/GHSA-2r57-2mrh-ggjv

hiddenlayer.com/sai-security-advisory/ydata-june2024

nvd.nist.gov/vuln/detail/CVE-2024-37063

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for GHSA-2R57-2MRH-GGJV