website-0.0.0.tgz: 3 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - website-0.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: ec1fa8fe06df49cf7ec57193ad15f8c80c1d8ec1

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (website version)	Remediation Possible**
MSC-2024-8222	Critical	9.8	intersection-observer-0.12.2.tgz	Transitive	N/A*	❌
CVE-2024-43788	Medium	6.4	webpack-4.47.0.tgz	Transitive	N/A*	❌
CVE-2024-11831	Medium	5.4	serialize-javascript-4.0.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

MSC-2024-8222

Vulnerable Library - intersection-observer-0.12.2.tgz

A polyfill for IntersectionObserver

Library home page: https://registry.npmjs.org/intersection-observer/-/intersection-observer-0.12.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• website-0.0.0.tgz (Root Library)
  • components-6.6.6.tgz
    • nextra-theme-docs-3.0.0-alpha.32.tgz
      • ❌ intersection-observer-0.12.2.tgz (Vulnerable Library)

Found in HEAD commit: ec1fa8fe06df49cf7ec57193ad15f8c80c1d8ec1

Found in base branch: master

Vulnerability Details

A malicious Polyfill reference has been identified in this package. The issue is located in the file "package\intersection-observer-test.html".
To address this security concern, we recommend taking one of two actions: either remove the affected file completely or replace the suspicious reference with a trusted alternative. Reliable Polyfill sources include Cloudflare (https://cdnjs.cloudflare.com/polyfill) and Fastly (https://community.fastly.com/t/new-options-for-polyfill-io-users/2540).
Mend Note: For more detailed information about the Polyfill supply chain attack and its widespread impact, you can refer to our comprehensive blog post at https://www.mend.io/blog/more-than-100k-sites-impacted-by-polyfill-supply-chain-attack/.

Publish Date: 2024-07-04

URL: MSC-2024-8222

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2024-43788

Vulnerable Library - webpack-4.47.0.tgz

Library home page: https://registry.npmjs.org/webpack/-/webpack-4.47.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• website-0.0.0.tgz (Root Library)
  • components-6.6.6.tgz
    • next-videos-1.5.0.tgz
      • file-loader-4.3.0.tgz
        • ❌ webpack-4.47.0.tgz (Vulnerable Library)

Found in HEAD commit: ec1fa8fe06df49cf7ec57193ad15f8c80c1d8ec1

Found in base branch: master

Vulnerability Details

Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.

Publish Date: 2024-08-27

URL: CVE-2024-43788

CVSS 3 Score Details (6.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-43788

Release Date: 2024-08-27

Fix Resolution: buddy/deploy-buddy - dev-132_fix

Step up your Open Source Security Game with Mend here

CVE-2024-11831

Vulnerable Library - serialize-javascript-4.0.0.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• website-0.0.0.tgz (Root Library)
  • components-6.6.6.tgz
    • next-videos-1.5.0.tgz
      • file-loader-4.3.0.tgz
        • webpack-4.47.0.tgz
          • terser-webpack-plugin-1.4.6.tgz
            • ❌ serialize-javascript-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: ec1fa8fe06df49cf7ec57193ad15f8c80c1d8ec1

Found in base branch: master

Vulnerability Details

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Publish Date: 2025-02-10

URL: CVE-2024-11831

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p7-773f-r4q5

Release Date: 2025-02-10

Fix Resolution: serialize-javascript - 6.0.2

Step up your Open Source Security Game with Mend here