What is GHSA-633r-r4p8-pw3w?

GHSA-633r-r4p8-pw3w is a security advisory published by GitHub Security Advisories with Medium severity. Cross site scripting in Metro UI

Which CVE IDs does GHSA-633r-r4p8-pw3w cover?

GHSA-633r-r4p8-pw3w covers the following CVE IDs: CVE-2022-41376. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-633r-r4p8-pw3w?

GHSA-633r-r4p8-pw3w has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-633r-r4p8-pw3w?

GHSA-633r-r4p8-pw3w affects 1 product, including: npm/metro4:\u003e= 4.4.0, \u003c= 4.5.1.

GHSA-633r-r4p8-pw3wMediumCVSS 6.1

Cross site scripting in Metro UI

Vendor

GitHub Security Advisories

Published

October 11, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-41376 →

📋 Description

Metro UI v4.4.0 to v4.5.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. User input is not properly sanitized before rendering in the textarea component.

🎯 Affected products1

npm/metro4:>= 4.4.0, <= 4.5.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-41376
https://alicangonullu.org/konu/138
https://youtu.be/_wzGVpX54Rc
https://github.com/advisories/GHSA-633r-r4p8-pw3w