Lucene search
Veracode Vulnerability DatabaseVERACODE:32078HistorySep 13, 2021 - 8:55 a.m.
Cross-site Scripting (XSS)
2021-09-1308:55:02
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
cross-site scripting
@theia/plugin-ext
vulnerability
EPSS
0.001
Percentile
38.4%
@theia/plugin-ext is vulnerable to cross-site scripting. An attacker is able to exploit the vulnerability by injecting malicious script into the system via the hostMessaging function. The vulnerability exists due to the lack of origin or parent check.
References
bugs.eclipse.org/bugs/show_bug.cgi?id=575924
github.com/eclipse-theia/theia//commit/4e1619dc8ab84e8abd900cf7a21421b2b8ef7319
github.com/eclipse-theia/theia/blob/d3501165bb4e87c3612a1a02c34a1d16ab81802c/packages/plugin-ext/src/main/browser/webview/pre/host.js#L28
github.com/eclipse-theia/theia/pull/10125
Related
cvelist
cvelist
CVE-2021-41038
2021-11-10 17:05:11
prion
prion
Code injection
2021-11-10 17:15:00
osv
osv
Improper Verification of Communication Channel in @theia/plugin-ext
2021-11-15 17:40:51
CVE-2021-41038
2021-11-10 17:15:11
cve
cve
CVE-2021-41038
2021-11-10 17:15:11
github
github
Improper Verification of Communication Channel in @theia/plugin-ext
2021-11-15 17:40:51
nvd
nvd
CVE-2021-41038
2021-11-10 17:15:11