What is GHSA-4vvg-x86p-mvqc?

GHSA-4vvg-x86p-mvqc is a security advisory published by GitHub Security Advisories with Medium severity. Leaking of user information on Cross-Domain communication in sysend

Which CVE IDs does GHSA-4vvg-x86p-mvqc cover?

GHSA-4vvg-x86p-mvqc covers the following CVE IDs: CVE-2022-24762. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4vvg-x86p-mvqc?

GHSA-4vvg-x86p-mvqc has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-4vvg-x86p-mvqc?

GHSA-4vvg-x86p-mvqc affects 1 product, including: npm/sysend:\u003c 1.10.0.

GHSA-4vvg-x86p-mvqcMediumCVSS 6.5

Leaking of user information on Cross-Domain communication in sysend

Vendor

GitHub Security Advisories

Published

March 14, 2022

Last Modified

July 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-24762 →

📋 Description

Impact

Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted. This is not a big impact because it happens only on the same browser.

Patches

It has been patched in version 1.10.0

Workarounds

The only workaround is to not send sensitive information with sysend messages.

🎯 Affected products1

npm/sysend:< 1.10.0

🔗 References (6)

https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc
https://github.com/jcubic/sysend.js/issues/33
https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a
https://nvd.nist.gov/vuln/detail/CVE-2022-24762
https://github.com/jcubic/sysend.js/releases/tag/1.10.0
https://github.com/advisories/GHSA-4vvg-x86p-mvqc