6.5

CVE-2022-24762

Exploit

Exposure of Sensitive Information to an Unauthorized Actor in sysend.js

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sysend.Js Project ≫ Sysend.Js SwPlatformnode.js Version < 1.10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.67% 0.472
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
security-advisories@github.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a
Patch
Third Party Advisory
https://github.com/jcubic/sysend.js/issues/33
Third Party Advisory
Exploit
Issue Tracking
https://github.com/jcubic/sysend.js/releases/tag/1.10.0
Third Party Advisory
Release Notes
https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc
Third Party Advisory