CVE-2022-48345 — Cross-site Scripting in Braintree Sanitize-url

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 28.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Paypal Braintree Sanitize-urlBraintree Sanitize-urlDebian Node-mermaid
Timeline
PublishedFeb 24

Description

sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
@braintree/sanitize-url Cross-site Scripting vulnerability↗2023-02-24
▶
GHSA
@braintree/sanitize-url Cross-site Scripting vulnerability↗2023-02-24
▶
OSV
CVE-2022-48345: sanitize-url (aka @braintree/sanitize-url) before 6↗2023-02-24
▶

📋Vendor Advisories

2
Red Hat
sanitize-url: XSS via HTML entities↗2023-02-24
▶
Debian
CVE-2022-48345: node-mermaid - sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML enti...↗2022
▶