GHSA-vrv9-3x3w-ffxw

    Dashboard / Vulnerabilities / GHSA-vrv9-3x3w-ffxw

    GHSA-vrv9-3x3w-ffxw

    Published: 1 Nov 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2022-3783

    Summary: node-red-dashboard vulnerable to Cross-site Scripting

    Details: node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file `components/ui-component/ui-component-ctrl.js` of the component ui_text Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-3783, https://github.com/node-red/node-red-dashboard/issues/772, https://github.com/node-red/node-red-dashboard/commit/9305d1a82f19b235dfad24a7d1dd4ed244db7743, https://github.com/node-red/node-red-dashboard, https://vuldb.com/?id.212555

    Affected packages

    Package

    Name: node-red-dashboard

    Purl: pkg:npm/node-red-dashboard

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.2.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-vrv9-3x3w-ffxw | CVE-DB