Cross site scripting

2014-02-2715:55:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.7%

JSON

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

CPENameOperatorVersion
ember.jseq1.2.0
ember.jseq1.4.0 beta
ember.jseq1.3.1
ember.jseq1.2.1
ember.jseq1.3.0

Name	Operator	Version
ember.js	eq	1.2.0
ember.js	eq	1.4.0 beta
ember.js	eq	1.3.1
ember.js	eq	1.2.1
ember.js	eq	1.3.0

References

emberjs.com/blog/2014/02/07/ember-security-releases.html

secunia.com/advisories/56965

www.openwall.com/lists/oss-security/2014/02/14/6

www.securityfocus.com/bid/65579

exchange.xforce.ibmcloud.com/vulnerabilities/91242

groups.google.com/forum/