CVE-2023-5654

Katalog CVE

CVSS 6.5 · Medium EPSS 0,47%

Kerentanan Improper Authorization pada facebook react-devtools. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.

Rincian

Terbit di NVD

19 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231 patch · advisory pihak ketiga