p PatchFirst

CVE-2024-47885

CVE-2024-47885 · astro's client-side router has DOM Clobbering Gadget that leads to XSS

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.

CVSS 5.9 · Media · EPSS 0,4% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • astro

    Versiones
    • >=3.0.0, < 4.16.1: Afectada

    Sin corrección publicada

  • astro npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 3.0.0, < 4.16.1

    Actualiza a 4.16.1

Fuentes originales

Comprueba tu servidor →