CVE-2018-3748: Cross-Site Scripting in glance
Summary
CVE-2018-3748: Cross-Site Scripting in glance. Affects glance versions < 3.0.8. Fixed in 3.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The glance package is an npm package used for various purposes. It serves files and allows users to control the name of the served files. This package is vulnerable to Stored Cross-Site Scripting (XSS) if the attacker can control the name of a file served by glance.
Vulnerability Detail
The vulnerability in glance allows an attacker to inject malicious scripts into the served files, which can be executed by unsuspecting users. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.0.8
This is the first release that contains the fix.
npm install glance@3.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed version as soon as possible.
Conclusion
In conclusion, the glance package before version 3.0.8 is vulnerable to Stored Cross-Site Scripting (XSS). It is crucial to update to the fixed version to mitigate the risk of script injection and potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for glance →
FAQ
The vulnerability allows an attacker to execute malicious scripts on the client-side, potentially leading to unauthorized access, data theft, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
There are no known public exploits for this vulnerability at the moment. However, it is important to update to the fixed version to prevent any potential attacks.
The only effective mitigation is to update the glance package to version 3.0.8 or higher. This ensures that the XSS vulnerability is patched and user-controlled file names are properly sanitized.
Yes, this vulnerability can be exploited remotely if the attacker can control the name of a file served by the glance package.
Related vulnerabilities
Recent vulnerabilities recorded for glance.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
