CVE-2020-15263: orchid/platform - Inline attribute values were not processed
Summary
CVE-2020-15263: Inline attribute values were not processed. Affects orchid/platform versions >= 9.0.0, < 9.4.4. Fixed in 9.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
orchid/platform is a package available on Packagist that provides a platform for building web applications. It offers various features and functionalities to developers, allowing them to create robust and dynamic web applications. However, a vulnerability has been identified in versions prior to 9.4.4 that affects the processing of inline attribute values.
Vulnerability Detail
The vulnerability arises from the failure to properly process inline attribute values. This can lead to a cross-site scripting (XSS) vulnerability if user-supplied data is not adequately sanitized. An attacker could exploit this vulnerability to inject malicious code into the application, potentially compromising user data, executing arbitrary scripts, or performing other unauthorized actions.
How To Fix
Minimum fixed version
9.4.4
This is the first release that contains the fix.
composer require orchid/platform:9.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The orchid/platform package prior to version 9.4.4 is vulnerable to a cross-site scripting (XSS) attack due to the improper processing of inline attribute values. It is crucial for developers to update their dependencies to the latest version to mitigate this vulnerability and ensure the security of their web applications. For further assistance and guidance, please reach out to DevNack.com.
See every vulnerability recorded for orchid/platform →
FAQ
The impact of this vulnerability is the potential for cross-site scripting (XSS) attacks. Attackers can inject malicious code into the application, leading to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and the playground will analyze it for any open-source vulnerabilities, including this one.
No, there are no known workarounds for this vulnerability. It is recommended to update the orchid/platform package to the latest version to ensure the security of your web application.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
For more information about this vulnerability, you can contact info@devnack.com. They can provide further support and guidance on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for orchid/platform.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
