Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04Mmg5LXY4dmgtbWZwcc4AAwC1
Browsershot vulnerable to Cross-Site Scripting (XSS)
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
Permalink: https://github.com/advisories/GHSA-82h9-v8vh-mfpqJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04Mmg5LXY4dmgtbWZwcc4AAwC1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: about 1 year ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-82h9-v8vh-mfpq, CVE-2022-43983
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-43983
- https://fluidattacks.com/advisories/khalid/
- https://github.com/spatie/browsershot/commit/92cf16fc098211731f80d21687abeafbe2c457ad
- https://github.com/advisories/GHSA-82h9-v8vh-mfpq
Blast Radius: 18.5
Affected Packages
packagist:spatie/browsershot
Dependent packages: 57Dependent repositories: 1,067
Downloads: 14,582,467 total
Affected Version Ranges: < 3.57.3
Fixed in: 3.57.3
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.9.1, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.1, 3.9.0, 3.10.0, 3.11.0, 3.11.1, 3.12.0, 3.13.0, 3.14.0, 3.14.1, 3.15.0, 3.16.0, 3.16.1, 3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.20.1, 3.22.0, 3.22.1, 3.23.0, 3.23.1, 3.24.0, 3.25.0, 3.25.1, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.27.0, 3.29.0, 3.30.0, 3.31.0, 3.31.1, 3.32.0, 3.32.1, 3.32.2, 3.33.0, 3.33.1, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.37.1, 3.37.2, 3.38.0, 3.39.0, 3.40.0, 3.40.1, 3.40.2, 3.40.3, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.44.0, 3.44.1, 3.45.0, 3.46.0, 3.47.0, 3.48.0, 3.49.0, 3.50.0, 3.50.1, 3.50.2, 3.51.0, 3.52.0, 3.52.1, 3.52.2, 3.52.3, 3.52.4, 3.52.5, 3.52.6, 3.53.0, 3.54.0, 3.55.0, 3.56.0, 3.57.0, 3.57.1, 3.57.2
All unaffected versions: 3.57.3, 3.57.4, 3.57.5, 3.57.6, 3.57.7, 3.57.8, 3.58.0, 3.58.1, 3.58.2, 3.59.0, 3.60.0, 3.60.1, 3.60.2, 3.61.0, 4.0.0, 4.0.1, 4.0.2