Vulnerability · Published Apr 20, 2023 · Assigned by VulDB

CVE-2022-4942mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in eslint-detailed-reporter from mportuga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The patch is identified as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	eslint-detailed-reporter	no fix listed	GHSA-4xr4-89m5-46c7

Affected products (as reported)

Vendor	Product	Versions
mportuga	eslint-detailed-reporter	0.10.20.30.40.50.60.70.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://vuldb.com/?id.226310 vdb-entry, technical-description
https://vuldb.com/?ctiid.226310 signature, permissions-required
https://github.com/mportuga/eslint-detailed-reporter/pull/46 issue-tracking
https://github.com/mportuga/eslint-detailed-reporter/commit/505c190efd4905990db6207863bdcbd9b1d7e1bd patch