CVE-2024-11831

Summary

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Affected Software

VendorProductVersion RangeStatus
6.0 < 6.0.2affected
Red HatRed Hat Advanced Cluster Security 4.44.4.8-2 < *unaffected
Red HatRed Hat Advanced Cluster Security 4.54.5.6-2 < *unaffected
Red HatRed Hat Ceph Storage 7.12:18.2.1-381.el8cp < *unaffected
Red HatRed Hat Ceph Storage 8.12:19.2.1-292.el9cp < *unaffected
Red HatRed Hat Ceph Storage 9.02:20.1.0-144.el10cp < *unaffected
Red HatRed Hat Enterprise Linux 80:8.0.112-1.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 90:8.0.112-1.el9_5 < *unaffected
Red HatRHODF-4.14-RHEL-9v4.14.18-2 < *unaffected
Red HatRHODF-4.14-RHEL-9v4.14.18-3 < *unaffected
Red HatRHODF-4.14-RHEL-9v4.14.18-2 < *unaffected
Red HatRHODF-4.15-RHEL-9v4.15.14-2 < *unaffected
Red HatRHODF-4.15-RHEL-9v4.15.14-2 < *unaffected
Red HatRHODF-4.15-RHEL-9v4.15.14-2 < *unaffected
Red HatRHODF-4.16-RHEL-9v4.16.10-4 < *unaffected
Red HatRHODF-4.16-RHEL-9v4.16.10-4 < *unaffected
Red HatRHODF-4.16-RHEL-9v4.16.10-3 < *unaffected
Red HatRHODF-4.17-RHEL-9v4.17.7-2 < *unaffected
Red HatRHODF-4.17-RHEL-9v4.17.7-2 < *unaffected
Red HatRHODF-4.17-RHEL-9v4.17.7-2 < *unaffected
Red HatRHODF-4.18-RHEL-9v4.18.2-8 < *unaffected
Red HatRHODF-4.18-RHEL-9v4.18.2-7 < *unaffected
Red HatRHODF-4.18-RHEL-9v4.18.2-8 < *unaffected
Red HatRed Hat Ceph Storage 88 < *unaffected
Red HatRed Hat Ceph Storage 9.01776359884 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.14.6v1.14.6-1744143767 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.15v1.15.3-1746939886 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.15v1.15.3-1746936251 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.16v1.16.4-1747983385 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.16v1.16.4-1747979846 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.17v1.17.2-1749452800 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.17v1.17.2-1750066936 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.18.0v1.18.1-1747749913 < *unaffected
Red HatRed Hat OpenShift Pipelines 1.19v1.19.0-1752127853 < *unaffected

Weaknesses

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References