Cross Site Scripting in evershop - @evershop/evershop

Description

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.

Recommendation

Update the @evershop/evershop package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-rc.5
• Patched version(s): 1.0.0-rc.5

References

• GHSA-m6vm-ff9v-jp3r
• devhub.checkmarx.com
• CVE-2023-46494
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in evershop - CVE-2023-46499
• Cross-site Scripting in evershop - @evershop/evershop - GHSA-2xcj-557c-hf8r - CVE-2023-46495
• Cross-site Scripting in cesium - CVE-2023-48094
• webmention.js Cross-site Scripting vulnerability - CVE-2023-3672

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@evershop/evershop