GHSA-9qgh-7pgp-hp7r

Source

https://github.com/advisories/GHSA-9qgh-7pgp-hp7r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-9qgh-7pgp-hp7r/GHSA-9qgh-7pgp-hp7r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9qgh-7pgp-hp7r

Published

2020-09-03T17:10:31Z

Modified

2020-08-31T18:44:42Z

Summary

Cross-Site Scripting in graylog-web-interface

Details

All versions of graylog-web-interface are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the TypeAhead and QueryInput components, which may allow attackers to execute arbitrary JavaScript on the victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:44:42Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/1028

Affected packages

npm / graylog-web-interface

Package

Name: graylog-web-interface; View open source insights on deps.dev
Purl: pkg:npm/graylog-web-interface

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-9qgh-7pgp-hp7r/GHSA-9qgh-7pgp-hp7r.json"