Moderate severityNVD Advisory· Published Sep 18, 2022· Updated Sep 17, 2024
Cross-site Scripting (XSS)
CVE-2022-25873
Description
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vuetifynpm | >= 2.0.0-beta.4, < 2.6.10 | 2.6.10 |
org.webjars.npm:vuetifyMaven | >= 2.0.0-beta.4, < 2.6.10 | 2.6.10 |
Affected products
3- vuetify/vuetifydescription
- ghsa-coords2 versions
>= 2.0.0-beta.4, < 2.6.10+ 1 more
- (no CPE)range: >= 2.0.0-beta.4, < 2.6.10
- (no CPE)range: >= 2.0.0-beta.4, < 2.6.10
Patches
Vulnerability mechanics
Synthesis attempt was rejected by the grounding validator. Re-run pending.
References
8- github.com/advisories/GHSA-q4q5-c5cv-2p68ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-25873ghsaADVISORY
- codepen.io/5v3n-08/pen/MWGKEjYghsax_refsource_MISCWEB
- github.com/vuetifyjs/vuetify/commit/ade1434927f55a0eccf3d54f900f24c5fa85a176ghsax_refsource_MISCWEB
- github.com/vuetifyjs/vuetify/issues/15757ghsax_refsource_MISCWEB
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVUETIFYJS-3024407ghsax_refsource_MISCWEB
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406ghsax_refsource_MISCWEB
- security.snyk.io/vuln/SNYK-JS-VUETIFY-3019858ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.