CVE-2022-0776

MEDIUMNuclei

Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0776 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

hakimel/reveal.js

Browse hakimel / hakimel/reveal.js
CVE ListBefore 4.3.0affected

reveal.js

Browse npm / reveal.js
GitHub AdvisoryBefore 4.3.0 · Fixed in 4.3.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMRevealJS postMessage <4.3.0 - Cross-Site ScriptingCVSS 6.1

RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to RevealJS postMessage version 4.3.0 or later to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsLogicalHunter
Template tagscvecve2022hackeronehuntrheadlesspostmessagerevealjsnode.jsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:revealjs:reveal.js:*:*:*:*:*:node.js:*:*
https://hackerone.com/reports/691977 https://github.com/hakimel/reveal.js/pull/3137 https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/ https://nvd.nist.gov/vuln/detail/CVE-2022-0776 https://github.com/hakimel/reveal.js/commit/32cdd3b1872ba8e2267c9e87ae216cb55f40f4d2

Source: ProjectDiscovery

References

4