CVE-2015-8862
MEDIUM6.1EPSS 0.13%Cross-Site Scripting in mustache
發布日:2017/10/24修改日:2023/11/8
描述
Versions of `mustache` prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted. ### Example Template: ```<a href={{foo}}/>``` Input: ```{ 'foo' : 'test.com onload=alert(1)'}``` Rendered result: ```<a href=test.com onload=alert(1)/>``` ## Recommendation Update to version 2.2.1 or later. Alternatively, ensure that all attributes in hmustache templates are encapsulated with quotes.
受影響套件(2)
- Debian/mustache.jsfrom 0
- npm/mustachefrom 0, < 2.2.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
參考連結(9)
- ADVISORYhttps://github.com/advisories/GHSA-w3w8-37jv-2c58
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2015-8862
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-8862
- PATCHhttps://github.com/janl/mustache.js
- WEBhttps://github.com/janl/mustache.js/commit/378bcca8a5cfe4058f294a3dbb78e8755e8e0da5
- WEBhttps://www.npmjs.com/advisories/62
- WEBhttps://www.tenable.com/security/tns-2016-18
- WEBhttp://www.openwall.com/lists/oss-security/2016/04/20/11
- WEBhttp://www.securityfocus.com/bid/96436