Overview
- Description
- In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 2.6
- Impact score
- 2.9
- Exploitability score
- 4.9
- Vector string
- AV:N/AC:H/Au:N/C:N/I:P/A:N
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:emberjs:ember.js:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "41A481D2-4EBC-467F-A853-7D413A51E843",
"versionEndExcluding": "1.0.0"
},
{
"criteria": "cpe:2.3:a:emberjs:ember.js:1.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "566747B2-6B01-47CE-8E3E-EE41E734CB0C"
},
{
"criteria": "cpe:2.3:a:emberjs:ember.js:1.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7129C1F-17EB-4FF0-9C98-F967716D82D4"
},
{
"criteria": "cpe:2.3:a:emberjs:ember.js:1.0.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD322617-FC0D-442A-9A29-DB7141BA9F67"
},
{
"criteria": "cpe:2.3:a:emberjs:ember.js:1.0.0:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51AEB9F0-5AC6-4420-BBEE-ECD30A3A1147"
},
{
"criteria": "cpe:2.3:a:emberjs:ember.js:1.0.0:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4263C3AB-7D4B-4F45-915E-1417106E3FC1"
},
{
"criteria": "cpe:2.3:a:emberjs:ember.js:1.0.0:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95DF583D-1DB8-4B53-A027-3FC23770EF64"
}
],
"operator": "OR"
}
]
}
]