CVE-2018-17574: Cross-site Scripting in yapi-vendor
Summary
CVE-2018-17574: Cross-site Scripting in yapi-vendor. Affects yapi-vendor versions < 1.3.23. Fixed in 1.3.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YMFE YApi is an open-source project management platform that allows users to create and manage projects. The yapi-vendor package is a dependency of YMFE YApi and is responsible for handling various vendor libraries. This vulnerability affects version 1.3.23 of yapi-vendor. The package is commonly used in Node.js applications and can be installed via the npm package manager.
Vulnerability Detail
The vulnerability identified as CVE-2018-17574 is a stored cross-site scripting (XSS) issue that exists in the name field of a project in YMFE YApi. This means that an attacker can inject malicious code into the name field, which will be executed when the project is viewed by other users. The impact of this vulnerability can range from unauthorized data access to full control of user sessions, depending on the nature of the injected code. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.3.23
This is the first release that contains the fix.
npm install yapi-vendor@1.3.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a temporary workaround is to sanitize the input in the name field to prevent the execution of malicious code. This can be done by implementing input validation and sanitization measures on the server-side. Here is an example of how to sanitize the name field using the 'xss' library in Node.js:
const xss = require('xss');
const sanitizedName = xss(name);
Conclusion
In conclusion, the yapi-vendor package in YMFE YApi is vulnerable to a stored cross-site scripting (XSS) issue. Upgrading to version 1.3.23 or implementing input sanitization measures can mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yapi-vendor →
FAQ
YMFE YApi is an open-source project management platform that allows users to create and manage projects. It provides features such as interface management, mock data generation, and API documentation.
yapi-vendor is a package that handles vendor libraries in YMFE YApi. It is a dependency of YMFE YApi and is responsible for managing and integrating various vendor libraries used in the project.
Stored cross-site scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious code into a website or web application. The injected code is then executed when other users view the affected page, potentially leading to unauthorized data access or the compromise of user sessions.
The impact of this vulnerability can vary depending on the injected code. It can range from unauthorized data access to full control of user sessions. The severity of the impact is determined by the nature of the injected code and the privileges of the affected user.
To fix this vulnerability, it is recommended to upgrade to version 1.3.23 of the yapi-vendor package. This version includes a patch that addresses the XSS vulnerability. Alternatively, you can sanitize the input in the name field on the server-side to prevent the execution of malicious code.
Related vulnerabilities
Recent vulnerabilities recorded for yapi-vendor.
