CVE-2019-15782: XSS

Q: What attacker-controlled content can trigger the issue?

A title or file name can be used to inject script content into the WebTorrent HTTP server response.

Q: Does exploitation require authentication or direct user interaction?

The CVSS vector indicates no privileges are required, but user interaction is required. The attacker must get a user to interact with content served through the affected HTTP server.

Q: Which versions should be remediated?

WebTorrent versions before 0.107.6 are affected. Update to 0.107.6 or later, as a patch is available.

Published Aug 29, 2019

Updated

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.

Affected Software

1 affected component

WebTorrent WebTorrent<0.107.6

Remediation

Patch Available

https://github.com/webtorrent/webtorrent/compare/v0.107.5...v0.107.6

Patch Available

https://github.com/webtorrent/webtorrent/pull/1714

Event History

Aug 29, 2019

CVE Published

via MITRE·11:07 AM

Data Sourced

via MITRE·11:07 AM

Description

Frequently Asked Questions

What attacker-controlled content can trigger the issue?

A title or file name can be used to inject script content into the WebTorrent HTTP server response.

Does exploitation require authentication or direct user interaction?

The CVSS vector indicates no privileges are required, but user interaction is required. The attacker must get a user to interact with content served through the affected HTTP server.

Which versions should be remediated?

WebTorrent versions before 0.107.6 are affected. Update to 0.107.6 or later, as a patch is available.

CVE-2019-15782: XSS

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What attacker-controlled content can trigger the issue?

Does exploitation require authentication or direct user interaction?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

What attacker-controlled content can trigger the issue?

Does exploitation require authentication or direct user interaction?

Which versions should be remediated?