CVE-2023-46495: XSS
Published Dec 8, 2023
·Updated
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.
Affected Software
13 affected componentsFixes available
npm/@evershop/evershop<1.0.0-rc.8
1.0.0-rc.8
evershop Evershop Node.js=1.0.0-beta
evershop Evershop Node.js=1.0.0-beta1
evershop Evershop Node.js=1.0.0-beta2
evershop Evershop Node.js=1.0.0-beta3
evershop Evershop Node.js=1.0.0-beta4
evershop Evershop Node.js=1.0.0-beta5
evershop Evershop Node.js=1.0.0-rc1
evershop Evershop Node.js=1.0.0-rc2
evershop Evershop Node.js=1.0.0-rc3
evershop Evershop Node.js=1.0.0-rc5
evershop Evershop Node.js=1.0.0-rc6
evershop Evershop Node.js=1.0.0-rc7
Event History
Dec 8, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Advisory Published
09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-46495?
CVE-2023-46495 is classified as a Cross Site Scripting vulnerability.
2
How do I fix CVE-2023-46495?
To fix CVE-2023-46495, upgrade your EverShop NPM package to version 1.0.0-rc.8 or later.
3
What versions of EverShop are affected by CVE-2023-46495?
CVE-2023-46495 affects EverShop NPM versions prior to 1.0.0-rc.8.
4
What type of attack does CVE-2023-46495 enable?
CVE-2023-46495 allows an attacker to obtain sensitive information via crafted requests.
5
Can I still use EverShop if I have CVE-2023-46495?
Yes, but it is recommended to upgrade to the patched version to mitigate the vulnerability.