Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (serialize-javascript)

CVE-2024-11831
MEDIUM 5.4

At a glance

Source
NVD
EPSS
EPSS 1.12 % · percentile 66 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Search on…

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Weaknesses (CWE)

  • CWE-79 — Improper Neutralization of Input During Web Page Generation

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nredhat
CVSS 3.1MEDIUM 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NNVD · secalert@redhat.com (Secondary)

Advisories

European references

CERT-FR advisories

Affected products

ProductVersions
serialize-javascriptaffected 6.0 < 6.0.2
Red Hat · Red Hat Advanced Cluster Security 4.4unaffected 4.4.8-2 < *
Red Hat · Red Hat Advanced Cluster Security 4.5unaffected 4.5.6-2 < *
Red Hat · Red Hat Ceph Storage 7.1unaffected 2:18.2.1-381.el8cp < *
Red Hat · Red Hat Ceph Storage 8.1unaffected 2:19.2.1-292.el9cp < *
Red Hat · Red Hat Ceph Storage 9.0unaffected 2:20.1.0-144.el10cp < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:8.0.112-1.el8_10 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:8.0.112-1.el9_5 < *
Red Hat · RHODF-4.14-RHEL-9unaffected v4.14.18-2 < *
Red Hat · RHODF-4.14-RHEL-9unaffected v4.14.18-3 < *
Red Hat · RHODF-4.14-RHEL-9unaffected v4.14.18-2 < *
Red Hat · RHODF-4.15-RHEL-9unaffected v4.15.14-2 < *
Red Hat · RHODF-4.15-RHEL-9unaffected v4.15.14-2 < *
Red Hat · RHODF-4.15-RHEL-9unaffected v4.15.14-2 < *
Red Hat · RHODF-4.16-RHEL-9unaffected v4.16.10-4 < *
Red Hat · RHODF-4.16-RHEL-9unaffected v4.16.10-4 < *
Red Hat · RHODF-4.16-RHEL-9unaffected v4.16.10-3 < *
Red Hat · RHODF-4.17-RHEL-9unaffected v4.17.7-2 < *
Red Hat · RHODF-4.17-RHEL-9unaffected v4.17.7-2 < *
Red Hat · RHODF-4.17-RHEL-9unaffected v4.17.7-2 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD