PT-2023-12182

CVE-2021-32850

Publicado

2023-02-20

Atualizado

2024-02-29

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jQuery MiniColors versions prior to 2.3.6

Description The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors.

Recommendations For versions prior to 2.3.6, update to version 2.3.6 to resolve the issue. As a temporary workaround, consider validating and sanitizing color names to prevent cross-site scripting attacks.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Erik Krogh Kristensen

Erik-Krogh

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados