CVE-2018-3748 Cross-Site Scripting in glance
MediumCVSS 6.1
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm glance(npm) | < 3.0.8 | 3.0.8 |
| glance project glance | = 3.0.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit third-party-advisory
- github.com
- www.npmjs.com
- github.com patch