CVE-2022-0437

MEDIUMNuclei

Cross-site Scripting (XSS) - DOM in karma-runner/karma

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0437 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

karma-runner/karma

Browse karma-runner / karma-runner/karma
CVE ListBefore 6.3.14affected

karma

Browse npm / karma
GitHub AdvisoryBefore 6.3.14 · Fixed in 6.3.14affected

Nuclei templates

1
ProjectDiscoveryMEDIUMkarma-runner DOM-based Cross-Site ScriptingCVSS 6.1

NPM karma prior to 6.3.14. contains a DOM-based cross-site Scripting vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to the latest version of karma-runner that includes proper input sanitization to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2022cveosshuntrkarmaxsskarma_projectnode.jspassivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:karma_project:karma:*:*:*:*:*:node.js:*:*
https://huntr.dev/bounties/64b67ea1-5487-4382-a5f6-e8a95f798885 https://github.com/karma-runner/karma/commit/839578c45a8ac42fbc1d72105f97eab77dd3eb8a https://nvd.nist.gov/vuln/detail/CVE-2022-0437 https://github.com/karma-runner/karma https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

5