Lucene search

GitHub Advisory DatabaseGHSA-6VFW-74WR-3CHH

HistoryJan 28, 2022 - 12:03 a.m.

Cross-site Scripting in Crater Invoice

2022-01-2800:03:42

CWE-79

GitHub Advisory Database

github.com

crater invoice

cross-site scripting

vulnerability

version 6.0.0

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability.

Affected configurations

Vulners

Node

bytefurycraterRange<6.0.0

VendorProductVersionCPE
bytefurycrater*cpe:2.3:a:bytefury:crater:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bytefury	crater	*	cpe:2.3:a:bytefury:crater::::::::

References

github.com/advisories/GHSA-6vfw-74wr-3chh

github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d

github.com/crater-invoice/crater/pull/681

huntr.dev/bounties/563232b9-5a93-4f4d-8389-ed805b262ef1

nvd.nist.gov/vuln/detail/CVE-2022-0372

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for GHSA-6VFW-74WR-3CHH