요약
- CVE-2021-41086은(는) jsuites (jsuites), jsuites에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.91%, 전체 취약점의 60.3%보다 높음.
- 조치: 4.9.11 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| jsuites | < 4.9.11
| 4.9.11
|
| jsuites npm | < 4.9.11
| 4.9.11
|
Description
Impact
XSS against the user.
Details
jsuites is vulnerable to DOM based XSS if the user can be tricked into copying anything from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to innerHTML causing XSS.
References
The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers: https://research.securitum.com/the-curious-case-of-copy-paste/
NVD description
jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free