CVE-2024-47875

Katalog CVE

CVSS 6.1 · Medium EPSS 1,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cure53 dompurify. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

Rincian

Terbit di NVD

11 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f patch
• https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a patch
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf exploit · advisory pihak ketiga
• https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098 product
• http://seclists.org/fulldisclosure/2025/Apr/14
• https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html