In breve
- CVE-2018-3755 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda sexstatic (sexstatic project), sexstatic.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.92%, superiore al 60.4% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| sexstatic | = 0.6.0= 0.6.2
| No fix yet |
| sexstatic npm | ≤ 0.6.2
| No fix yet |
Description
All versions of sexstatic are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by sexstatic.
Recommendation
As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.
NVD description
XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free