Description

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.

Remediation

References

https://bugs.chromium.org/p/chromium/issues/detail?id=759111

https://github.com/GoogleChrome/rendertron/commit/8d70628c96ae72eff6eebb451d26fc9ed6b58b0e

https://github.com/GoogleChrome/rendertron/pull/88

Related Vulnerabilities

CVE-2017-17068 Vulnerability in maven package org.webjars.npm:auth0-js

CVE-2020-26299 Vulnerability in npm package ftp-srv

CVE-2022-46907 Vulnerability in maven package org.apache.jspwiki:jspwiki-main

CVE-2020-7772 Vulnerability in npm package doc-path

CVE-2021-42228 Vulnerability in npm package kindeditor

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory Patch