Lucene search

GitHub Advisory DatabaseGHSA-CX3J-QQXJ-9597

HistoryAug 11, 2023 - 6:57 p.m.

Critters Cross-site Scripting Vulnerability

2023-08-1118:57:53

CWE-79

CWE-80

CWE-116

GitHub Advisory Database

github.com

critters

xss

vulnerability

patched

v0.0.20

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

26.5%

JSON

Impact

Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential cross-site scripting (XSS) bug.

Patches

The bug has been fixed in v0.0.20.

Workarounds

Upgrading Critters version to >0.0.20 is the easiest fix. This is a non breaking version upgrade so we recommend all users to use v0.0.20.

Affected configurations

Vulners

Node

googlecrittersRange≤0.0.19

VendorProductVersionCPE
googlecritters*cpe:2.3:a:google:critters:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	critters	*	cpe:2.3:a:google:critters::::::::

References

github.com/advisories/GHSA-cx3j-qqxj-9597

github.com/GoogleChromeLabs/critters/commit/7757902c9e0b3285d516359b3cb602cd9d50d80e

github.com/GoogleChromeLabs/critters/pull/133

github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597

nvd.nist.gov/vuln/detail/CVE-2023-3481

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

26.5%

JSON

Related for GHSA-CX3J-QQXJ-9597