Cross-Site Scripting Vulnerability in DOMPurify SVG and MATH Elements
CVE-2019-16728

6.1MEDIUM

Key Information:

Vendor

Cure53

Status
Dompurify
Vendor
CVE Published:
24 September 2019

What is CVE-2019-16728?

DOMPurify versions before 2.0.1 are susceptible to a cross-site scripting vulnerability stemming from innerHTML mutation for SVG and MATH elements. This vulnerability can be exploited in various web browsers such as Chrome and Safari, allowing malicious actors to execute unintended scripts in the context of the affected application. Developers should upgrade to the latest version to mitigate potential security risks.

References

https://research.securitum.com/dompurify-bypass-using-mxss/
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2020/10/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.