Kurz gesagt
- CVE-2018-3755 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in sexstatic (sexstatic project), sexstatic.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.92%, höher als bei 60.4% aller Schwachstellen.
- Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.
| Package | Affected versions | Patched versions |
|---|
| sexstatic | = 0.6.0= 0.6.2
| No fix yet |
| sexstatic npm | ≤ 0.6.2
| No fix yet |
Description
All versions of sexstatic are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by sexstatic.
Recommendation
As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.
NVD description
XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free