CVE-2019-16728: XSS

Reference Links

• https://nvd.nist.gov/vuln/detail/CVE-2019-16728
• https://research.securitum.com/dompurify-bypass-using-mxss/
• https://www.npmjs.com/advisories/1205
• https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html
• https://github.com/advisories/GHSA-chqj-j4fh-rw7m (Advisory)
• https://exchange.xforce.ibmcloud.com/vulnerabilities/167570
• https://www.ibm.com/support/pages/node/7047202 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7047202

Frequently Asked Questions

• What is the vulnerability ID for this issue?

  The vulnerability ID is CVE-2019-16728.

• What is the severity level of CVE-2019-16728?

  The severity of CVE-2019-16728 is medium (6.1).

• What is the affected software for CVE-2019-16728?

  The affected software for CVE-2019-16728 includes versions of `dompurify` prior to 2.0.3 and IBM Security Verify Privilege On-Premises (all versions).

• How does the vulnerability in CVE-2019-16728 occur?

  The vulnerability in CVE-2019-16728 occurs due to an XSS filter bypass in `dompurify` caused by improper validation of user-supplied input.

• How can I fix the vulnerability in CVE-2019-16728?

  To fix the vulnerability in CVE-2019-16728, upgrade to version 2.0.3 or later of `dompurify` or apply the necessary security patches provided by the software vendor.