sanitize-html
En bref
- Source
- NVD
- EPSS
- EPSS 1.03 % · centile 64 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- snyk
- Statut NVD
- Analyzed
Description
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
- CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory
Références
- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
- https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
- https://github.com/apostrophecms/sanitize-html/pull/650
- https://github.com/apostrophecms/apostrophe/discussions/4436
- https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P | snyk |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · report@snyk.io (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-rm97-x556-q36h — sanitize-html Information Exposure vulnerability
Références européennes
- ENISA EUVD · EUVD-2024-0719
- GCVE · GCVE-0-2024-21501
Avis du CERT-FR
- CERTFR-2024-AVI-0726 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0366 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*< 2.12.1cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| sanitize-html | affected 0 < 2.12.1 |
| org.webjars.npm:sanitize-html | affected 0 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |