En bref
- CVE-2021-41086 est une vulnérabilité MOYENNE (CVSS 5.4) touchant jsuites (jsuites), jsuites.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.91%, plus élevée que 60.3% des vulnérabilités.
- Correctif : mettre à jour vers 4.9.11 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| jsuites | < 4.9.11
| 4.9.11
|
| jsuites npm | < 4.9.11
| 4.9.11
|
Description
Impact
XSS against the user.
Details
jsuites is vulnerable to DOM based XSS if the user can be tricked into copying anything from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to innerHTML causing XSS.
References
The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers: https://research.securitum.com/the-curious-case-of-copy-paste/
NVD description
jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free