CVE-2024-9283 - RelaxedJS ReLaXed Pug to PDF Converter cross site scripting

Back Back to CVE browser

MEDIUM

RelaxedJS ReLaXed Pug to PDF Converter cross site scripting

Published Sep 27, 2024

4.8

MEDIUM

CVSS 4.0

EPSS 0.27%

Description

A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF Converter. The manipulation leads to cross site scripting. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Affected products

Vendor RelaxedJS Product ReLaXed Default
n/a
- Version
  0.2.0
  Status
  affected
  Constraints
  -
- Version
  0.2.1
  Status
  affected
  Constraints
  -
- Version
  0.2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

RelaxedJS

ReLaXed

n/a

Version	Status	Constraints
0.2.0	affected	-
0.2.1	affected	-
0.2.2	affected	-

Ecosystem	Package	Introduced	Fixed
npm	relaxedjs	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://drive.google.com/file/d/1Ll1dRwQds8987S-l5o2iJu4MQRG-p4-A/view?usp=sharing
exploit
https://github.com/advisories/GHSA-gj3p-j74v-3x57
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-9283
https://vuldb.com/?ctiid.278676
signaturepermissions-required
https://vuldb.com/?id.278676
vdb-entry
https://vuldb.com/?submit.411185
third-party-advisory

Link	Providers	Tags
https://drive.google.com/file/d/1Ll1dRwQds8987S-l5o2iJu4MQRG-p4-A/view?usp=sharing		exploit
https://github.com/advisories/GHSA-gj3p-j74v-3x57		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-9283
https://vuldb.com/?ctiid.278676		signaturepermissions-required
https://vuldb.com/?id.278676		vdb-entry
https://vuldb.com/?submit.411185		third-party-advisory