Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS04Mmg5LXY4dmgtbWZwcc4AAwC1

Browsershot vulnerable to Cross-Site Scripting (XSS)

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.

Permalink: https://github.com/advisories/GHSA-82h9-v8vh-mfpq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04Mmg5LXY4dmgtbWZwcc4AAwC1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: almost 2 years ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-82h9-v8vh-mfpq, CVE-2022-43983
References: Repository: https://github.com/spatie/browsershot
Blast Radius: 18.5

Affected Packages

packagist:spatie/browsershot
Dependent packages: 63
Dependent repositories: 1,067
Downloads: 18,207,332 total
Affected Version Ranges: < 3.57.3
Fixed in: 3.57.3
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.9.1, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.1, 3.9.0, 3.10.0, 3.11.0, 3.11.1, 3.12.0, 3.13.0, 3.14.0, 3.14.1, 3.15.0, 3.16.0, 3.16.1, 3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.20.1, 3.22.0, 3.22.1, 3.23.0, 3.23.1, 3.24.0, 3.25.0, 3.25.1, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.27.0, 3.29.0, 3.30.0, 3.31.0, 3.31.1, 3.32.0, 3.32.1, 3.32.2, 3.33.0, 3.33.1, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.37.1, 3.37.2, 3.38.0, 3.39.0, 3.40.0, 3.40.1, 3.40.2, 3.40.3, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.44.0, 3.44.1, 3.45.0, 3.46.0, 3.47.0, 3.48.0, 3.49.0, 3.50.0, 3.50.1, 3.50.2, 3.51.0, 3.52.0, 3.52.1, 3.52.2, 3.52.3, 3.52.4, 3.52.5, 3.52.6, 3.53.0, 3.54.0, 3.55.0, 3.56.0, 3.57.0, 3.57.1, 3.57.2
All unaffected versions: 3.57.3, 3.57.4, 3.57.5, 3.57.6, 3.57.7, 3.57.8, 3.58.0, 3.58.1, 3.58.2, 3.59.0, 3.60.0, 3.60.1, 3.60.2, 3.61.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.2.0, 4.2.1, 4.3.0