Vulnerability · Published Jul 16, 2023 · Assigned by VulDB

CVE-2023-3691layui HTML Attribute cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in layui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	layui	2.8.0	GHSA-hx4h-676r-j3qp

Affected products (as reported)

Vendor	Product	Versions
n/a	layui	v2.8.0-rc.0v2.8.0-rc.1v2.8.0-rc.2v2.8.0-rc.3v2.8.0-rc.4v2.8.0-rc.5v2.8.0-rc.6v2.8.0-rc.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://vuldb.com/?id.234237 vdb-entry, technical-description
https://vuldb.com/?ctiid.234237 signature, permissions-required
https://gitee.com/layui/layui/issues/I7HDXZ issue-tracking
https://gitee.com/layui/layui/tree/v2.8.0 patch