webpack-5.93.0.tgz: 1 vulnerabilities (highest severity is: 6.4) - autoclosed

[mend-for-github-com[bot]]

Vulnerable Library - webpack-5.93.0.tgz

Library home page: https://registry.npmjs.org/webpack/-/webpack-5.93.0.tgz

Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (webpack version)	Remediation Possible**	Reachability
CVE-2024-43788	Medium	6.4	webpack-5.93.0.tgz	Direct	webpack - 5.94.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-43788

### Vulnerable Library - webpack-5.93.0.tgz

Library home page: https://registry.npmjs.org/webpack/-/webpack-5.93.0.tgz

Dependency Hierarchy: - :x: **webpack-5.93.0.tgz** (Vulnerable Library)

Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d

Found in base branch: main

### Vulnerability Details

Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.

Publish Date: 2024-08-27

URL: CVE-2024-43788

### CVSS 3 Score Details (6.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986

Release Date: 2024-08-27

Fix Resolution: webpack - 5.94.0

[mend-for-github-com[bot]]

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #66

[mend-for-github-com[bot]]

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #66