Is CVE-2024-47075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-47075 being exploited in the wild.

How severe is CVE-2024-47075?

Low severity, with a CVSS score of 3.1, published 26 September 2024.

Which products and versions are affected?

layui (npm) SEMVER:introduced=0,fixed=2.9.17.

Is there a fix for CVE-2024-47075?

Yes. layui (npm): upgrade to 2.9.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-47075 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-47075?

Check whether you run layui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-47075: Layui DOM Clobbering leading to Cross-site Scripting

CVE-2024-47075 · Severity: low · CVSS 3.1 · Published 2024-09-26

Layui is a popular JavaScript UI framework used to build interactive web interfaces. A DOM Clobbering vulnerability allows attackers to inject specially crafted HTML elements (like img tags with unsanitized attributes) that can be transformed into executable code, leading to Cross-site Scripting (XSS) attacks. This could allow attackers to steal user data, session credentials, or perform unauthorized actions on behalf of users.

Technologies: layui (npm). Vendors: npm.

Quick answers

Is CVE-2024-47075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-47075 being exploited in the wild.
How severe is CVE-2024-47075?: Low severity, with a CVSS score of 3.1, published 26 September 2024.
Which products and versions are affected?: layui (npm) SEMVER:introduced=0,fixed=2.9.17.
Is there a fix for CVE-2024-47075?: Yes. layui (npm): upgrade to 2.9.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-47075 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-47075?: Check whether you run layui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

layui (npm): upgrade to 2.9.17 or later
```
npm install layui@2.9.17
```

Technical details

A DOM Clobbering vulnerability exists in Layui where attacker-controlled HTML elements with unsanitized name or id attributes can be leveraged through gadgets in the library to execute arbitrary JavaScript code. The vulnerability is triggered when web pages allow users to inject scriptless HTML tags (such as img elements) without proper sanitization. An attacker with ability to inject HTML into a page (e.g., via comments or posts) can exploit this to achieve XSS without directly injecting script tags. The vulnerability requires low privileges and high attack complexity but allows confidentiality and integrity impacts with high availability impact. This issue has been patched in Layui version 2.9.17; users should upgrade immediately.

Affected products

Layui Layui < 2.9.17

Identifiers

CVE-2024-47075
GHSA-j827-6rgf-9629

Timeline

2024-09-26: disclosed
2024-09-26: patched: Fixed in version 2.9.17

References

https://github.com/layui/layui/security/advisories/GHSA-j827-6rgf-9629

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.