CVE-2016-15025
generator-hottowel 404 Error _app.js cross site scripting
Also known as GHSA-f8hv-rx9p-f9r4
Published 3 y ago · modified 4 mo ago · JSON
Summary
A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is c17092fd4103143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221484.
Exploit prediction (EPSS)
0.53% probability of exploitation in the next 30 days, higher than 45% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | generator-hottowel | <0.5.0 | 0.5.0 |
Affected products
- n/a generator-hottowel
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- vuldb.com /?id.221484 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.221484 · signature, permissions-required, x_transferred
- github.com /johnpapa/generator-hottowel/pull/174 · issue-tracking, x_transferred
- github.com /johnpapa/generator-hottowel/commit/c17092fd4103143a9ddab93c8983ace8bf174396 · patch, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-15025 · advisory
- github.com /johnpapa/generator-hottowel · package
Sources
- CVE List: CVE-2016-15025
- GitHub Advisory: GHSA-f8hv-rx9p-f9r4
- NVD: CVE-2016-15025
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.