CVE-2020-15262

Katalog CVE

CVSS 3.7 · Low EPSS 0,52%

Kerentanan Insufficient Verification of Data Authenticity pada webpack-subresource-integrity project webpack-subresource-integrity. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.

Rincian

Terbit di NVD

19 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f patch · advisory pihak ketiga
• https://github.com/waysact/webpack-subresource-integrity/issues/131 advisory pihak ketiga
• https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh advisory pihak ketiga