Is CVE-2013-7035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2013-7035 being exploited in the wild.

How severe is CVE-2013-7035?

Low severity, with a CVSS score of 3.1, published 4 September 2020.

Which products and versions are affected?

React SEMVER:introduced=0.4.0,fixed=0.4.2.

Is there a fix for CVE-2013-7035?

Yes. React: upgrade to 0.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2013-7035 attacked?

It is attacked over the network.

Am I affected by CVE-2013-7035?

Check whether you run React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2013-7035: React cross-site scripting in key generation

CVE-2013-7035 · Severity: low · CVSS 3.1 · Published 2020-09-04

React, a popular JavaScript library for building web applications, failed to properly sanitize user input when generating component keys. This vulnerability allows attackers to inject malicious JavaScript that executes in the context of users' browsers, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.

Technologies: React.

Quick answers

Is CVE-2013-7035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2013-7035 being exploited in the wild.
How severe is CVE-2013-7035?: Low severity, with a CVSS score of 3.1, published 4 September 2020.
Which products and versions are affected?: React SEMVER:introduced=0.4.0,fixed=0.4.2.
Is there a fix for CVE-2013-7035?: Yes. React: upgrade to 0.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-7035 attacked?: It is attacked over the network.
Am I affected by CVE-2013-7035?: Check whether you run React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

React: upgrade to 0.4.2 or later

Technical details

React versions 0.4.0–0.4.1 and 0.5.0–0.5.1 contain a cross-site scripting (XSS) vulnerability in the ReactTextComponent module. The rootID parameter was not properly escaped when constructing the HTML span element, allowing attacker-controlled input to break out of HTML attributes and inject arbitrary JavaScript. The vulnerability requires user interaction (rendering a component with attacker-supplied keys) but does not require authentication. The fix escapes the rootID using the escapeTextForBrowser function before embedding it in HTML. Patches are available in React 0.4.2 and 0.5.2.

Affected products

Meta React 0.4.0–0.4.1, 0.5.0–0.5.1

Identifiers

CVE-2013-7035
GHSA-g53w-52xc-2j85

Timeline

2013-12-18: disclosed: React 0.4.2 and 0.5.2 released with fixes
2020-09-04: advisory

References

https://github.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.