CVE-2019-10756 - It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default

Back Back to CVE browser

MEDIUM

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default

Published Oct 8, 2019

5.4

MEDIUM

CVSS 3.1

EPSS 0.57%

Description

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.

Affected products

Vendor n/a Product Node-Red-Dashboard Default
n/a
- Version
  All versions prior to version 2.17.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Node-Red-Dashboard

n/a

Version	Status	Constraints
All versions prior to version 2.17.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	node-red-dashboard	0	2.17.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/advisories/GHSA-xg59-m7wx-853q
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10756
https://snyk.io/vuln/SNYK-JS-NODEREDDASHBOARD-471939
x_refsource_CONFIRMExploitThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-xg59-m7wx-853q		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10756
https://snyk.io/vuln/SNYK-JS-NODEREDDASHBOARD-471939		x_refsource_CONFIRMExploitThird Party Advisory