metascraper before v5.2.0 vulnerable to stored cross-site scripting · CVE-2018-3773 · GitHub Advisory Database · GitHub

metascraper before v5.2.0 vulnerable to stored cross-site scripting

Moderate severity GitHub Reviewed Published Aug 8, 2018 to the GitHub Advisory Database • Updated Jan 31, 2023

Package

metascraper (npm)

Affected versions

< 5.2.0

Patched versions

5.2.0

Description

Versions of metascraper prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS).

Recommendation

Upgrade to version 5.2.0 or later.

References

Published by the National Vulnerability Database

Jul 30, 2018

Published to the GitHub Advisory Database Aug 8, 2018

Reviewed Jun 16, 2020

Last updated Jan 31, 2023

Severity

Moderate

6.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N