Cross-site Scripting (XSS)

2023-05-1202:17:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

vulnerability

library

confirmation dialogue

malicious javascript

url

software

0.003 Low

EPSS

Percentile

65.8%

JSON

rollout-ui is vulnerable to Cross-site Scripting (XSS). The vulnerability exists because the feature’s name attribute in the library does not properly escape in the Do you really want to delete confirmation dialogue when the user clicks Delete, which allows an attacker to inject and execute malicious JavaScript via maliciously crafted URL

CPENameOperatorVersion
rollout-uile0.5.2
rollout-uile0.5.2

CPE	Name	Operator	Version
	rollout-ui	le	0.5.2
	rollout-ui	le	0.5.2

References

fetlife.com

rollout-ui.com

cxsecurity.com/issue/WLB-2023050012

github.com/advisories/GHSA-5xq9-h3j2-jxvc

github.com/fetlife/rollout-ui/commit/6d202d2cbcae3dd9b92c1f5ab7be17b48d78c045

github.com/fetlife/rollout-ui/pull/15

packetstormsecurity.com/files/172185/Rollout-UI-0.5-Cross-Site-Scripting.html

0.003 Low

EPSS

Percentile

65.8%

JSON

Related for VERACODE:40482