CVE-2021-23648: Cross-site Scripting (XSS)
A flaw was found in sanitize-url due to improper sanitization in the sanitizeUrl function. This issue causes vulnerability to Cross-site Scripting in sanitize-url.
Other sources
Node.js @braintree/sanitize-url module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el8 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el9 - Upgrade
Upgrade
redhat/sanitize-urlto a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-23648?
CVE-2021-23648 is a vulnerability in the sanitize-url package that allows for cross-site scripting (XSS) attacks.
What is the severity of CVE-2021-23648?
CVE-2021-23648 has a severity rating of 6.1, which is considered medium.
How does CVE-2021-23648 impact sanitize-url?
CVE-2021-23648 allows attackers to perform cross-site scripting (XSS) attacks through the sanitizeUrl function in sanitize-url.
What is the remedy for CVE-2021-23648?
The remedy for CVE-2021-23648 is to upgrade to version 6.0.0 of the sanitize-url package.
Where can I find more information about CVE-2021-23648?
You can find more information about CVE-2021-23648 in the bug reports on Bugzilla and the pull request on GitHub.