CVE-2019-14862

Опубликовано: 02 янв. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862
Issue Tracking
Patch
Third Party Advisory
https://snyk.io/vuln/npm:knockout:20180213
Exploit
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862
Issue Tracking
Patch
Third Party Advisory
https://snyk.io/vuln/npm:knockout:20180213
Exploit
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:knockoutjs:knockout:*:*:*:*:*:*:*:*

Версия до 3.4.2 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:goldengate:12.3.0.1.2:*:*:*:*:*:*:*

EPSS

Процентиль: 36%

0.00149

Низкий

6.1 Medium

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2019-14862

CVSS3: 6.1

ubuntu

около 6 лет назад

CVE-2019-14862

CVSS3: 6.1

redhat

больше 6 лет назад

CVE-2019-14862

CVSS3: 6.1

debian

около 6 лет назад

There is a vulnerability in knockout before version 3.5.0-beta, where ...

GHSA-vcjj-xf2r-mwvc

CVSS3: 6.1

github

почти 6 лет назад

XSS in knockout

BDU:2020-04506

CVSS3: 6.1

fstec

около 6 лет назад

Уязвимость библиотеки Knockout.js, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществить межсайтовую сценарную атаку

EPSS

Процентиль: 36%

0.00149

Низкий

6.1 Medium

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79