En bref
- CVE-2018-3755 est une vulnérabilité MOYENNE (CVSS 6.1) touchant sexstatic (sexstatic project), sexstatic.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.92%, plus élevée que 60.4% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| sexstatic | = 0.6.0= 0.6.2
| No fix yet |
| sexstatic npm | ≤ 0.6.2
| No fix yet |
Description
All versions of sexstatic are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by sexstatic.
Recommendation
As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.
NVD description
XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free