Leaking of user information on Cross-Domain communication in sysend

Description

Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted. This is not a big impact because it happens only on the same browser.

Recommendation

Update the sysend package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.0
• Patched version(s): 1.10.0

References

• GHSA-4vvg-x86p-mvqc
• CVE-2022-24762
• CWE-200
• CWE-346
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Strapi leaking sensitive user information by filtering on private fields - CVE-2023-22894
• Leaking sensitive user information still possible by filtering on private with prefix fields (GHSA-9xg4-3qfm-9w8f) - CVE-2023-34235
• Leaking sensitive user information still possible by filtering on private with prefix fields - CVE-2023-34235
• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349

Tags:

npm

sysend