GHSA-hhqj-cfjx-vj25

Source

https://github.com/advisories/GHSA-hhqj-cfjx-vj25

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-hhqj-cfjx-vj25/GHSA-hhqj-cfjx-vj25.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hhqj-cfjx-vj25

Aliases

CVE-2022-0776

Published

2022-03-02T00:00:20Z

Modified

2023-11-08T04:07:40.540384Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross site scripting in reveal.js

Details

The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute arbitrary javascript code on victim's browser window hosting reveal.js

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-02T21:28:45Z",
    "severity": "MODERATE",
    "nvd_published_at": "2022-03-01T09:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

npm / reveal.js

Package

Name: reveal.js; View open source insights on deps.dev
Purl: pkg:npm/reveal.js

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-hhqj-cfjx-vj25/GHSA-hhqj-cfjx-vj25.json"