Lucene search

Veracode Vulnerability DatabaseVERACODE:40937

HistoryJun 18, 2023 - 6:57 a.m.

Cross-site Scripting (XSS)

2023-06-1806:57:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

html escaping

template engine

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

38.7%

JSON

jstachio is vulnerable to Cross-site Scripting (XSS). The vulnerability exists because the HtmlEscaper.java does not properly escape single quotes ' in HTML, which allows an attacker to inject and execute malicious javascript in the context of other users visiting pages that use this template engine.

CPENameOperatorVersion
jstachiole1.0.0
jstachiole1.0.0

CPE	Name	Operator	Version
	jstachio	le	1.0.0
	jstachio	le	1.0.0

References

github.com/jstachio/jstachio/commit/7b2f78377d1284df14c580be762a25af5f8dcd66

github.com/jstachio/jstachio/issues/157

github.com/jstachio/jstachio/pull/158

github.com/jstachio/jstachio/releases/tag/v1.0.1

github.com/jstachio/jstachio/security/advisories/GHSA-gwxv-jv83-6qjr

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

38.7%

JSON

Related for VERACODE:40937