CVE-2021-32859

Summary

The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted placeholder entries. An attacker who is able to influence the field placeholder when creating a Calendar instance is able to supply arbitrary html or javascript that will be rendered in the context of a user leading to XSS. There are no known patches for this issue.

Affected Software

Weaknesses

• CWE-79: CWE-79 Cross-site Scripting (XSS)

ADP Enrichment

CVE Program Container

Additional References

• https://securitylab.github.com/advisories/GHSL-2021-1042_Baremetrics_Date_Range_Picker/
• https://github.com/Baremetrics/calendar/blob/240c20134ffbf0f0f246a50feff2be1ff19cf349/public/js/Calendar.js#L724

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://securitylab.github.com/advisories/GHSL-2021-1042_Baremetrics_Date_Range_Picker/
• https://github.com/Baremetrics/calendar/blob/240c20134ffbf0f0f246a50feff2be1ff19cf349/public/js/Calendar.js#L724

• ←Previous
• Next→