GHSA-CX7R-634M-2Q2H中危已审查已撤回

Cross-Site Scripting in harp

OSV 1.4.0 · github-reviewed · 修改于 2021-06-02 06:21

发布时间

2020-09-03 02:20

GitHub 审查时间

2020-09-01 02:36

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/09/GHSA-cx7r-634m-2q2h/GHSA-cx7r-634m-2q2h.json

该公告已于 2021-06-02 06:21 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Withdrawn

This advisory has been withdrawn per request from the maintainer. Given harp is a static webserver, a XSS type of vulnerability is not appropriate.

Original advisory description

All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, harp does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

受影响的软件包

npm

harp

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

无

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-cx7r-634m-2q2h",
  "aliases": [],
  "details": "# Withdrawn\n\nThis advisory has been withdrawn per request from the maintainer.  Given harp is a static webserver, a XSS type of vulnerability is not appropriate.\n\n### Original advisory description\n\nAll versions of `harp` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `harp` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.",
  "summary": "Cross-Site Scripting in harp",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "package": {
        "name": "harp",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2021-06-01T22:21:08Z",
  "severity": [],
  "published": "2020-09-02T18:20:21Z",
  "withdrawn": "2021-06-01T22:21:08Z",
  "references": [
    {
      "url": "https://hackerone.com/reports/453795",
      "type": "WEB"
    },
    {
      "url": "https://www.npmjs.com/advisories/806",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-31T18:36:27Z"
  }
}