CVE-2021-41086CWE-79

Clipboard-based XSS in jsuites

High · published September 21, 2021

CVSS v3.1
8.7
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00914 · 59.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-21T21:00Z
EPSS history
Timeline
  • 21 SEP 21:00Z
    Clipboard-based XSS in jsuites
    cvelistv5