5.4
CVE-2023-25572
- EPSS 1.23%
- Veröffentlicht 13.02.2023 21:15:15
- Zuletzt bearbeitet 21.11.2024 07:49:45
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Loginreact-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `<RichTextField>` are affected. `<RichTextField>` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `<RichTextField>` by a custom field doing sanitization by hand.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Marmelab ≫ Ra-ui-materialui SwPlatformnode.js Version < 3.9.12
Marmelab ≫ Ra-ui-materialui SwPlatformnode.js Version >= 4.0.0 < 4.7.6
Marmelab ≫ React-admin SwPlatformnode.js Version < 3.9.12
Marmelab ≫ React-admin SwPlatformnode.js Version >= 4.0.0 < 4.7.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.23% | 0.789 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| security-advisories@github.com | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.