Lucene search

Veracode Vulnerability DatabaseVERACODE:47732

HistoryJun 25, 2024 - 6:40 a.m.

Cross Site Scripting(XSS)

2024-06-2506:40:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

xss

user inputs

browser

vulnerability

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6 Medium

AI Score

Confidence

High

JSON

ydata_profiling is vulnerable to a Cross-site scripting (XSS) vulnerability. This vulnerability is due to insufficient sanitization of user-supplied inputs in reports, allowing malicious payloads to execute when these reports are viewed in the browser.

CPENameOperatorVersion
ydata-profilingle4.8.3
ydata-profilingle4.8.3

CPE	Name	Operator	Version
	ydata-profiling	le	4.8.3
	ydata-profiling	le	4.8.3

References

github.com/advisories/GHSA-2r57-2mrh-ggjv

github.com/ydataai/ydata-profiling/blob/159fe0d025722568b6c54e2916254c79582327b3/src/ydata_profiling/profile_report.py#L54

hiddenlayer.com/sai-security-advisory/ydata-june2024

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6 Medium

AI Score

Confidence

High

JSON

Related for VERACODE:47732