CVE-2022-24762

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-24762

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24762.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-24762

Aliases

GHSA-4vvg-x86p-mvqc

Published

2022-03-14T22:50:10Z

Modified

2026-04-10T04:46:01.835017Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Exposure of Sensitive Information to an Unauthorized Actor in sysend.js

Details

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24762.json"
}

References

Affected packages

Git / github.com/jcubic/sysend

Affected ranges

Type: GIT
Repo: https://github.com/jcubic/sysend
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a24f4b776fb18191ae0f7e3d90c2c7bec459431a

Fixed

990556bded1aa798564c67330c222ea663cafde4

Affected versions

1.*

1.0.1

1.1.0

1.2.0

1.3.3

1.3.4

1.3.5

1.5.0

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

1.8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24762.json"

Git / github.com/jcubic/sysend.js