Description

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.

Remediation

References

https://github.com/zeit/next.js/releases/tag/7.0.2

Related Vulnerabilities

CVE-2022-34202 Vulnerability in maven package com.geteasyqa:easyqa

CVE-2021-33829 Vulnerability in npm package ckeditor4

CVE-2021-37942 Vulnerability in maven package co.elastic.apm:elastic-apm-agent

CVE-2023-4759 Vulnerability in maven package org.eclipse.jgit:org.eclipse.jgit

CVE-2022-35949 Vulnerability in npm package undici

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Release Notes Vendor Advisory