apollographql apollo-client-nextjs 0.7.0 Link cross site scripting

Summaryinfo

A vulnerability was found in apollographql apollo-client-nextjs 0.7.0 and classified as problematic. The impacted element is an unknown function of the component Link Handler. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2024-23841. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in apollographql apollo-client-nextjs 0.7.0. This vulnerability affects an unknown code of the component Link Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity. CVE summarizes:

apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.

The weakness was shared 01/30/2024 as GHSA-rv8p-rr2h-fgpg. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-23841 since 01/22/2024. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 0.7.0 eliminates this vulnerability. Applying the patch b92bc42abd5f8e17d4db361c36bd08e4f541a46b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• apollographql

Name

• apollo-client-nextjs

Version

• 0.7.0

License

• open-source

Website

• Product: https://github.com/apollographql/apollo-client-nextjs/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion