All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.
References
| Link | Resource |
|---|---|
| https://gist.github.com/dellalibera/c53448135480cbe12257c4b413a90d20 | Exploit |
| https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766 | Exploit Third Party Advisory |
| https://gist.github.com/dellalibera/c53448135480cbe12257c4b413a90d20 | Exploit |
| https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/dellalibera/c53448135480cbe12257c4b413a90d20 - Exploit | |
| References | () https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766 - Exploit, Third Party Advisory |
02 Oct 2023, 20:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ithewei
Ithewei libhv |
|
| CPE | cpe:2.3:a:ithewei:libhv:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-79 | |
| References | (MISC) https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766 - Exploit, Third Party Advisory | |
| References | (MISC) https://gist.github.com/dellalibera/c53448135480cbe12257c4b413a90d20 - Exploit |
29 Sep 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-29 05:15
Updated : 2024-11-21 07:50
NVD link : CVE-2023-26146
Mitre link : CVE-2023-26146
CVE.ORG link : CVE-2023-26146
JSON object : View
Products Affected
ithewei
- libhv
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')