Cross-site Scripting (XSS)

2023-07-0705:31:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sanitize vulnerability javascript browser执行 arbitary gsub parameter software

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

30.8%

JSON

sanitize is vulnerable to Cross-Site Scripting (XSS). The vulnerability exists due to a lack of sanitization in the gsub parameter of clean_css.rb, which allows an attacker to inject and execute arbitrary JavaScript into the browser.

CPENameOperatorVersion
sanitizele6.0.1
ruby-sanitize:bustereq4.6.6-2.1~deb10u1
ruby-sanitize:sideq5.2.1-2
ruby-sanitize:sideq4.6.6-2.1
sanitizele6.0.1
ruby-sanitize:bustereq4.6.6-2.1~deb10u1
ruby-sanitize:sideq5.2.1-2
ruby-sanitize:sideq4.6.6-2.1
ruby-sanitize:bullseyeeq4.6.6-2.1
ruby-sanitize:bookwormeq5.2.1-2

Name	Operator	Version
sanitize	le	6.0.1
ruby-sanitize:buster	eq	4.6.6-2.1~deb10u1
ruby-sanitize:sid	eq	5.2.1-2
ruby-sanitize:sid	eq	4.6.6-2.1
sanitize	le	6.0.1
ruby-sanitize:buster	eq	4.6.6-2.1~deb10u1
ruby-sanitize:sid	eq	5.2.1-2
ruby-sanitize:sid	eq	4.6.6-2.1
ruby-sanitize:bullseye	eq	4.6.6-2.1
ruby-sanitize:bookworm	eq	5.2.1-2