GHSA-5m48-c37x-f792

Suggest an improvement
Source
https://github.com/advisories/GHSA-5m48-c37x-f792
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5m48-c37x-f792
Aliases
  • CVE-2013-4170
Published
2022-07-01T00:01:11Z
Modified
2026-09-10T03:49:55Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
Details

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-07-12T21:27:47Z",
    "nvd_published_at":  "2022-06-30T13:15:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems
ember-source

Package

Name
ember-source
Purl
pkg:gem/ember-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.0.rc1.1

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
1.*
1.0.0.pre4.0
1.0.0.pre4.1
1.0.0.pre4.2
1.0.0.rc1.0.0

Database specific

last_known_affected_version_range 
"<= 1.0.0.rc1.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json"
ember-source

Package

Name
ember-source
Purl
pkg:gem/ember-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0.rc2.0
Fixed
1.0.0.rc2.1

Affected versions

1.*
1.0.0.rc2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json"
ember-source

Package

Name
ember-source
Purl
pkg:gem/ember-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0.rc3.0
Fixed
1.0.0.rc3.1

Affected versions

1.*
1.0.0.rc3
1.0.0.rc3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json"
ember-source

Package

Name
ember-source
Purl
pkg:gem/ember-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0.rc4.0
Fixed
1.0.0.rc4.1

Affected versions

1.*
1.0.0.rc4
1.0.0.rc4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json"
ember-source

Package

Name
ember-source
Purl
pkg:gem/ember-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0.rc5.0
Fixed
1.0.0.rc5.1

Affected versions

1.*
1.0.0.rc5
1.0.0.rc5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json"
ember-source

Package

Name
ember-source
Purl
pkg:gem/ember-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0.rc6.0
Fixed
1.0.0.rc6.1

Affected versions

1.*
1.0.0.rc6
1.0.0.rc6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-5m48-c37x-f792/GHSA-5m48-c37x-f792.json"