Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

WS-2022-0175

Good to know:

icon
icon
icon

Date: November 3, 2024

GrapesJs up to 0.19.4 vulnerable to Cross Site Scripting (XSS). Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager. Version 0.19.5 contains a patch for this issue.

Language: JS

Severity Score

Related Resources (5)

https://github.com/oroinc/orocommerce/security/advisories/GHSA-6f85-3f8q-qc94
https://github.com/artf/grapesjs/commit/13e85d152d486b968265c4b8017e8901e7d89ff3
https://github.com/artf/grapesjs/issues/4411
https://github.com/oroinc/orocommerce
https://www.mend.io/vulnerability-database/WS-2022-0175

Severity Score

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version grapesjs - 0.19.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us