Improper Neutralization Of Special Elements In Output Used By A Downstream Component ('Injection')

🗓️ 01 Apr 2024 06:04:21Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 17 Views

Astro-Shield vulnerability - inadequate content validation, CSP header injectio

Reporter	Title	Published	Views	Family All 13
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.16 and earlier	29 May 202414:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	29 Jul 202421:55	–	ibm
CNNVD	Astro-Shield 安全漏洞	28 Mar 202400:00	–	cnnvd
CVE	CVE-2024-29896	28 Mar 202412:48	–	cve
Cvelist	CVE-2024-29896 Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections	28 Mar 202412:48	–	cvelist
EUVD	EUVD-2024-1019	3 Oct 202520:07	–	euvd
Github Security Blog	Content-Security-Policy header generation in middleware could be compromised by malicious injections	29 Mar 202419:03	–	github
NVD	CVE-2024-29896	28 Mar 202413:15	–	nvd
OSV	CVE-2024-29896 Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections	28 Mar 202412:48	–	osv
OSV	GHSA-W387-5QQW-7G8M Content-Security-Policy header generation in middleware could be compromised by malicious injections	29 Mar 202419:03	–	osv

Vulners

Node

astro-shield @kindspells/astro-shieldMatch1.2.0js

Source	Link
github	www.github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d
github	www.github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m

02 Apr 2024 14:13Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.00949

SSVC

astro-shield vulnerability inadequate content validation csp header injection malicious resources.