Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, with a CVSS score of 6.1, published 13 June 2019.
- Which products and versions are affected?
- ids-enterprise (npm) SEMVER:introduced=0,fixed=4.18.2.
- Is there a fix for This vulnerability?
- Yes. ids-enterprise (npm): upgrade to 4.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network.
- Am I affected?
- Check whether you run ids-enterprise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ids-enterprise (npm): upgrade to 4.18.2 or later
npm install ids-enterprise@4.18.2
Technical details
The vulnerability is a reflected/stored Cross-Site Scripting (CWE-79) in the soho-autocomplete component of ids-enterprise versions prior to 4.18.2. Script tags are not properly encoded or sanitized in the autocomplete input handling, allowing attackers to break out of the data context and execute arbitrary JavaScript. The attack requires user interaction (e.g., viewing a malicious autocomplete suggestion) but does not require authentication. An attacker can exploit this to steal session cookies, perform actions on behalf of the user, or harvest sensitive data. The vulnerability is fixed in version 4.18.2 and later.
Affected products
- IDS ids-enterprise < 4.18.2
Timeline
- 2019-06-13: disclosed
- 2019-06-13: patched: Fix available in version 4.18.2