Cross-Site Scripting Issue in Public Module by npm
CVE-2018-16480

6.1MEDIUM

Key Information:

Vendor

Hackerone

Status
Public
Vendor
CVE Published:
1 February 2019

What is CVE-2018-16480?

An XSS vulnerability exists in the Public module (versions prior to 0.1.4) that permits the execution of malicious JavaScript code. This occurs because the module lacks proper sanitization of file and folder names before they are rendered in the browser. Attackers can exploit this loophole to execute arbitrary scripts, thereby potentially compromising the security of user sessions and sensitive data.

Affected Version(s)

public <0.1.4

References

https://hackerone.com/reports/329950
x_refsource_MISC
https://www.npmjs.com/package/public
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.