Описание
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.
Ссылки
- Patch
- Patch
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.0.0 (включая) до 3.21.7 (исключая)Версия от 4.0.0 (включая) до 4.4.7 (исключая)
Одно из
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*
EPSS
Процентиль: 35%
0.00413
Низкий
6.1 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 6.1
github
3 месяца назад
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.
EPSS
Процентиль: 35%
0.00413
Низкий
6.1 Medium
CVSS3
Дефекты
CWE-79