A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 (Reporting Software) and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity.

The weakness was published 04/18/2023 as 46. The advisory is available at github.com. This vulnerability is handled as CVE-2022-4942. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Applying the patch 505c190efd4905990db6207863bdcbd9b1d7e1bd is able to eliminate this problem. The bugfix is ready for download at github.com. The advisory contains the following remark:

fix(template-generator): fix xss problem in issue message
- use `_.escape` for html escape instead of `formatSourceCode`

Similar entries are available at VDB-257232, VDB-258621, VDB-260129 and VDB-268787.

Productinfo

Type

• Reporting Software

Vendor

• mportuga

Name

• eslint-detailed-reporter

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion