PT-2023-12182

CVE-2021-32850

Published

2023-02-20

Updated

2024-02-29

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jQuery MiniColors versions prior to 2.3.6

Description The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors.

Recommendations For versions prior to 2.3.6, update to version 2.3.6 to resolve the issue. As a temporary workaround, consider validating and sanitizing color names to prevent cross-site scripting attacks.

Exploitability

Exploit

Fix

Impacts

Researchers

Erik Krogh Kristensen

Erik-Krogh

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers