CVE-2023-3481

Summary

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension. 

Affected Software

Weaknesses

• CWE-80: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CWE-116: CWE-116 Improper Encoding or Escaping of Output

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597

• ←Previous
• Next→