Kurz gesagt
- CVE-2019-15607 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in node-red (nodered), node-red.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.64%, höher als bei 50.9% aller Schwachstellen.
- Abhilfe: auf 0.20.8 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| node-red | ≤ 0.20.7
| No fix yet |
| node-red npm | < 0.20.8
| 0.20.8
|
Description
Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 0.18.6 or later.
NVD description
A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free