GHSA-Q4QQ-FM7Q-CWP5 Multiple XSS Filter Bypasses in validator

🗓️ 24 Oct 2017 18:33:36Reported by GoogleType

osv🔗 osv.dev👁 19 Views

Multiple XSS Filter Bypasses in validator Versions of `validator` prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter. Improper parsing of nested tags, incomplete filtering of javascript: URIs, UI Redressing, and bypass via Nested Forbidden Strings were discovered. Recommendations include replacing the xss filter function with the escape filter function

Reporter	Title	Published	Views	Family All 21
Circl	CVE-2013-7454	24 Oct 201718:33	–	circl
CNVD	Joyent Node.js validator security bypass vulnerability (CNVD-2016-02546)	24 Apr 201600:00	–	cnvd
CVE	CVE-2013-7454	23 Jan 201721:00	–	cve
Cvelist	CVE-2013-7454	23 Jan 201721:00	–	cvelist
Debian CVE	CVE-2013-7454	23 Jan 201721:00	–	debiancve
EUVD	EUVD-2017-0286	7 Oct 202500:30	–	euvd
F5 Networks	K30110324: Multiple Node.js vulnerabilities	21 Feb 202318:55	–	f5
Github Security Blog	Multiple XSS Filter Bypasses in validator	24 Oct 201718:33	–	github
Node.js	Multiple XSS Filter Bypasses	17 Oct 201519:41	–	nodejs
NVD	CVE-2013-7454	23 Jan 201721:59	–	nvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-7454
github	www.github.com/advisories/GHSA-q4qq-fm7q-cwp5
nealpoole	www.nealpoole.com/blog/2013/07/xss-filter-bypass-in-validator-nodejs-module
npmjs	www.npmjs.com/advisories/41
blog	www.blog.kotowicz.net/2012/07/codeigniter-210-xssclean-cross-site.html
openwall	www.openwall.com/lists/oss-security/2016/04/20/11

08 Nov 2023 03:57Current

6.3Medium risk

Vulners AI Score6.3

CVSS 36.1

EPSS0.01857