Vulnerability · Published Mar 14, 2022 · Assigned by GitHub_M

CVE-2022-24762Exposure of Sensitive Information to an Unauthorized Actor in sysend.js

Medium 6.5

In plain English

A medium-severity information exposure in sysend.js from jcubic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	sysend	1.10.0	GHSA-4vvg-x86p-mvqc

Affected products (as reported)

Vendor	Product	Versions
jcubic	sysend.js	< 1.10.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc x_refsource_CONFIRM
https://github.com/jcubic/sysend.js/issues/33 x_refsource_MISC
https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a x_refsource_MISC
https://github.com/jcubic/sysend.js/releases/tag/1.10.0 x_refsource_MISC