Description

A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.

Remediation

References

https://hackerone.com/reports/319794

Related Vulnerabilities

CVE-2022-41940 Vulnerability in maven package org.webjars.npm:engine.io

CVE-2022-39312 Vulnerability in maven package io.dataease:dataease-plugin-common

CVE-2021-28169 Vulnerability in maven package org.eclipse.jetty:jetty-servlets

CVE-2021-3749 Vulnerability in npm package axios

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-properties

Severity

Medium

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory