CVE-2019-14862: XSS
Knockout is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14862?
CVE-2019-14862 is a vulnerability in Knockout before version 3.5.0-beta that allows for cross-site scripting attacks.
How does CVE-2019-14862 work?
CVE-2019-14862 works by improper validation of user-supplied input, allowing a remote attacker to inject malicious scripts that can be executed in a victim's web browser.
What is the severity of CVE-2019-14862?
The severity of CVE-2019-14862 is medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2019-14862?
Knockout before version 3.5.0-beta is affected by CVE-2019-14862.
How can I fix CVE-2019-14862?
To fix CVE-2019-14862, it is recommended to update to version 3.5.0-beta or later of Knockout.