What is GHSA-rp2c-jrgp-cvr8?

GHSA-rp2c-jrgp-cvr8 is a security advisory published by GitHub Security Advisories with Medium severity. Code injection in plupload

Which CVE IDs does GHSA-rp2c-jrgp-cvr8 cover?

GHSA-rp2c-jrgp-cvr8 covers the following CVE IDs: CVE-2021-23562. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rp2c-jrgp-cvr8?

GHSA-rp2c-jrgp-cvr8 has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-rp2c-jrgp-cvr8?

GHSA-rp2c-jrgp-cvr8 affects 1 product, including: npm/plupload:\u003c 2.3.9.

GHSA-rp2c-jrgp-cvr8MediumCVSS 4.2

Code injection in plupload

Vendor

GitHub Security Advisories

Published

December 16, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-23562 →

📋 Description

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.

🎯 Affected products1

npm/plupload:< 2.3.9

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2021-23562
https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb
https://github.com/moxiecode/plupload/blob/master/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664
https://snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909
https://github.com/advisories/GHSA-rp2c-jrgp-cvr8