CVE-2021-3377

MEDIUMNuclei

ansi_up cross-site scripting vulnerability

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2021-3377 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

ansi_up

Browse npm / ansi_up
GitHub AdvisoryBefore 5.0.0 · Fixed in 5.0.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMnpm ansi_up v4 - Cross-Site ScriptingCVSS 6.1

npm package ansi_up v4 is vulnerable to cross-site scripting because ANSI escape codes can be used to create HTML hyperlinks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a user's browser, leading to potential data theft or unauthorized actions.

Remediation

Upgrade to v5.0.0 or later.

WeaknessesCWE-79
Authorsgeeknik
Template tagscve2021cvexssnpmansi_up_projectnode.jsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ansi_up_project:ansi_up:*:*:*:*:*:node.js:*:*
https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27 https://nvd.nist.gov/vuln/detail/CVE-2021-3377 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4