Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes

🗓️ 20 Sep 2024 14:41:02Reported by GitHub Advisory DatabaseType

Plate allows custom DOM attributes for elements and leaves, posing XSS and information exposure risks. Patches restrict default attribute names, with select exceptions

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-47061	20 Sep 202422:15	–	circl
CNNVD	Plate 跨站脚本漏洞	20 Sep 202400:00	–	cnnvd
CVE	CVE-2024-47061	20 Sep 202419:04	–	cve
Cvelist	CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs	20 Sep 202419:04	–	cvelist
EUVD	EUVD-2024-2743	3 Oct 202520:07	–	euvd
NVD	CVE-2024-47061	20 Sep 202419:15	–	nvd
OSV	GHSA-73RG-F94J-XVHX Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes	20 Sep 202414:41	–	osv
Positive Technologies	PT-2024-32380 · Unknown · @Udecode/Plate-Core	20 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-47061	5 Feb 202508:23	–	redhatcve
Veracode	Cross-site Scripting (XSS)	25 Sep 202407:35	–	veracode

Vulners

Node

udecode plate-coreRange<21.5.1npm

udecode plate-coreRange22.0.0–36.5.9npm

udecode plate-coreRange37.0.0–38.0.6npm

Source	Link
github	www.github.com/udecode/plate/security/advisories/GHSA-73rg-f94j-xvhx
github	www.github.com/udecode/plate/commit/16df6074edac22d56c60e0283eae0740230401c9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-47061
npmjs	www.npmjs.com/package/patch-package
yarnpkg	www.yarnpkg.com/cli/patch
github	www.github.com/advisories/GHSA-73rg-f94j-xvhx

20 Sep 2024 22:07Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.18.3

EPSS0.00515

SSVC

CWE-79