CVE-2022-24762CWE-200

Exposure of Sensitive Information to an Unauthorized Actor in sysend.js

Medium · published March 14, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-03-14T22:50Z
EPSS history
Timeline
  • 14 MAR 22:50Z
    Exposure of Sensitive Information to an Unauthorized Actor in sysend.js
    cvelistv5