CVE-2013-7454 - The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings

MEDIUM

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings

Published Jan 23, 2017

6.1

MEDIUM

CVSS 3.0

EPSS 1.86%

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.

Ecosystem	Package	Introduced	Fixed
npm	validator	0	1.1.0

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
http://blog.kotowicz.net/2012/07/codeigniter-210-xssclean-cross-site.html
http://www.openwall.com/lists/oss-security/2016/04/20/11		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-q4qq-fm7q-cwp5		Advisory
https://nealpoole.com/blog/2013/07/xss-filter-bypass-in-validator-nodejs-module/
https://nodesecurity.io/advisories/41		x_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2013-7454
https://www.npmjs.com/advisories/41