What is GHSA-qfh2-6f7q-gr86?

GHSA-qfh2-6f7q-gr86 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in sexstatic

Which CVE IDs does GHSA-qfh2-6f7q-gr86 cover?

GHSA-qfh2-6f7q-gr86 covers the following CVE IDs: CVE-2018-3755. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qfh2-6f7q-gr86?

GHSA-qfh2-6f7q-gr86 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-qfh2-6f7q-gr86?

GHSA-qfh2-6f7q-gr86 affects 1 product, including: npm/sexstatic:\u003c= 0.6.2.

GHSA-qfh2-6f7q-gr86MediumCVSS 6.1

Cross-Site Scripting in sexstatic

Vendor

GitHub Security Advisories

Published

October 1, 2018

Last Modified

March 1, 2023

🔗 CVE IDs covered (1)

CVE-2018-3755 →

📋 Description

All versions of sexstatic are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by sexstatic.

Recommendation

As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.

🎯 Affected products1

npm/sexstatic:<= 0.6.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-3755
https://hackerone.com/reports/328210
https://github.com/advisories/GHSA-qfh2-6f7q-gr86
https://www.npmjs.com/advisories/671