CVE-2023-3481 - OpenCVE

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Critters

Configuration 1 [-]

cpe:2.3:a:google:critters:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597

History

No history.

MITRE

Status: PUBLISHED

Assigner: Google

Published: 2023-08-21T10:04:23.880Z

Updated: 2024-08-02T06:55:03.572Z

Reserved: 2023-06-30T10:02:06.942Z

Link: CVE-2023-3481

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-08-21T11:15:07.360

Modified: 2023-08-25T16:01:54.503

Link: CVE-2023-3481

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3481", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2023-06-30T10:02:06.942Z", "datePublished": "2023-08-21T10:04:23.880Z", "dateUpdated": "2024-08-02T06:55:03.572Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Critters", "vendor": "Google Chrome Labs", "versions": [{"lessThan": "0.0.19", "status": "affected", "version": "0.0.17", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension. "}], "value": "Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.\u00a0"}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2023-08-21T10:04:23.880Z"}, "references": [{"url": "https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597"}], "source": {"discovery": "UNKNOWN"}, "title": "XSS in Chrome Lab Critters", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:55:03.572Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597", "tags": ["x_transferred"]}]}]}}