Cross site scripting in @awsui/components-react
CVE-2022-24709

8.8HIGH

Key Information:

Vendor

Aws

Status
Awsui-documentation
Vendor
CVE Published:
24 February 2022

What is CVE-2022-24709?

@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Users are advised to upgrade to version 3.0.367 or later. There are no known workarounds for this issue.

Affected Version(s)

awsui-documentation < 3.0.367

References

https://github.com/aws/awsui-documentation/security/advis...
x_refsource_CONFIRM
https://www.npmjs.com/package/%40awsui/components-react
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-24709 : Cross site scripting in @awsui/components-react