CVE-2024-43788
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-43788
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-43788.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-43788
- Aliases
- Related
- Published
- 2024-08-27T17:15:07Z
- Modified
- 2024-10-12T11:29:45.420996Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s
AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., animgtag with an unsanitizednameattribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue. - References
-
- https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
- https://research.securitum.com/xss-in-amp4email-dom-clobbering
- https://scnps.co/papers/sp23_domclob.pdf
- https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
- https://github.com/webpack/webpack/issues/18718#issuecomment-2326296270
- https://security-tracker.debian.org/tracker/CVE-2024-43788
Affected packages
Debian:11 / node-webpack
Package
- Name
- node-webpack
- Purl
- pkg:deb/debian/node-webpack?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
4.*
4.43.0-6
4.43.0-6+deb11u1
4.43.0-7
5.*
5.6.0+~cs6.4.0-1~exp1
5.6.0+~cs6.4.0-1~exp2
5.58.2+~cs5.11.7-1
5.65.0+dfsg+~cs9.20.9-1
5.65.0+dfsg+~cs9.20.9-2
5.65.0+dfsg+~cs9.20.9-3
5.65.0+dfsg+~cs9.20.9-4
5.65.0+dfsg+~cs9.20.9-5
5.65.0+dfsg+~cs9.20.9-6
5.65.0+dfsg+~cs9.20.9-7
5.65.0+dfsg+~cs9.20.9-8
5.65.0+dfsg+~cs9.20.9-9
5.65.0+dfsg+~cs9.20.9-10
5.65.0+dfsg+~cs9.20.9-11
5.65.0+dfsg+~cs9.20.9-12
5.65.0+dfsg+~cs9.20.9-13
5.74.0+dfsg+~cs10.13.6-1
5.74.0+dfsg+~cs10.13.6-2
5.74.0+dfsg+~cs10.13.6-3
5.74.0+dfsg+~cs10.13.6-4
5.74.0+repack1+~cs9.13.6-1
5.75.0+dfsg+~cs10.3.6-1
5.75.0+dfsg+~cs17.16.14-1
5.76.1+dfsg1+~cs17.16.16-1
5.76.1+dfsg2+~cs10.8.15-2
5.76.1+dfsg2+~cs10.8.15-3
5.94.0+dfsg1+~cs11.18.26-1
5.94.0+dfsg1+~cs11.18.26-2
Debian:12 / node-webpack
Package
- Name
- node-webpack
- Purl
- pkg:deb/debian/node-webpack?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:13 / node-webpack
Package
- Name
- node-webpack
- Purl
- pkg:deb/debian/node-webpack?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.94.0+dfsg1+~cs11.18.26-2
Git / github.com/webpack/webpack
Affected ranges
- Type
- GIT
- Repo
- https://github.com/webpack/webpack
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v1.*
v1.0.0
v1.0.0-beta2
v1.0.0-beta3
v1.0.0-beta4
v1.0.0-beta5
v1.0.0-beta6
v1.0.0-beta7
v1.0.0-beta8
v1.0.0-beta9
v1.0.0-rc1
v1.0.0-rc10
v1.0.0-rc11
v1.0.0-rc12
v1.0.0-rc2
v1.0.0-rc3
v1.0.0-rc4
v1.0.0-rc5
v1.0.0-rc6
v1.0.0-rc7
v1.0.0-rc8
v1.0.0-rc9
v1.0.1
v1.0.3
v1.0.4
v1.0.5
v1.1.0
v1.1.0-beta1
v1.1.0-beta10
v1.1.0-beta11
v1.1.0-beta12
v1.1.0-beta2
v1.1.0-beta3
v1.1.0-beta4
v1.1.0-beta5
v1.1.0-beta6
v1.1.0-beta7
v1.1.0-beta8
v1.1.0-beta9
v1.1.1
v1.1.10
v1.1.11
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.12.9
v1.2.0-beta1
v1.2.0-beta2
v1.2.0-beta3
v1.2.0-beta4
v1.2.0-beta5
v1.2.0-beta6
v1.3.0-beta1
v1.3.0-beta2
v1.3.0-beta3
v1.3.0-beta4
v1.3.0-beta5
v1.3.0-beta6
v1.3.0-beta7
v1.3.0-beta8
v1.3.0-beta9
v1.3.1-beta1
v1.3.1-beta2
v1.3.1-beta3
v1.3.1-beta4
v1.3.1-beta5
v1.3.1-beta6
v1.3.1-beta7
v1.3.1-beta8
v1.3.1-beta9
v1.3.2-beta1
v1.3.2-beta2
v1.3.2-beta3
v1.3.2-beta4
v1.3.2-beta5
v1.3.2-beta6
v1.3.2-beta7
v1.3.2-beta8
v1.3.2-beta9
v1.3.3-beta1
v1.3.3-beta2
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.4.0-beta1
v1.4.0-beta10
v1.4.0-beta2
v1.4.0-beta3
v1.4.0-beta4
v1.4.0-beta5
v1.4.0-beta6
v1.4.0-beta7
v1.4.0-beta8
v1.4.0-beta9
v1.4.1-beta1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.1
v1.8.10
v1.8.11
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.10
v1.9.11
v1.9.12
v1.9.13
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9
v2.*
v2.0.0-beta
v2.0.1-beta
v2.0.2-beta
v2.0.3-beta
v2.0.4-beta
v2.0.5-beta
v2.0.6-beta
v2.0.7-beta
v2.1.0-beta.0
v2.1.0-beta.1
v2.1.0-beta.10
v2.1.0-beta.11
v2.1.0-beta.12
v2.1.0-beta.13
v2.1.0-beta.14
v2.1.0-beta.15
v2.1.0-beta.16
v2.1.0-beta.17
v2.1.0-beta.18
v2.1.0-beta.19
v2.1.0-beta.2
v2.1.0-beta.20
v2.1.0-beta.21
v2.1.0-beta.22
v2.1.0-beta.23
v2.1.0-beta.24
v2.1.0-beta.25
v2.1.0-beta.26
v2.1.0-beta.27
v2.1.0-beta.28
v2.1.0-beta.3
v2.1.0-beta.4
v2.1.0-beta.5
v2.1.0-beta.6
v2.1.0-beta.7
v2.1.0-beta.8
v2.1.0-beta.9
v2.2.0
v2.2.0-rc.0
v2.2.0-rc.1
v2.2.0-rc.2
v2.2.0-rc.3
v2.2.0-rc.4
v2.2.0-rc.5
v2.2.0-rc.6
v2.2.0-rc.7
v2.2.0-rc.8
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.4.1
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v3.*
v3.0.0
v3.0.0-rc.0
v3.0.0-rc.1
v3.0.0-rc.2
v3.1.0
v3.10.0
v3.11.0
v3.2.0
v3.3.0
v3.4.0
v3.4.1
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v3.5.6
v3.6.0
v3.7.0
v3.7.1
v3.8.0
v3.8.1
v3.9.0
v3.9.1
v4.*
v4.0.0
v4.0.0-alpha.0
v4.0.0-alpha.1
v4.0.0-alpha.2
v4.0.0-alpha.3
v4.0.0-alpha.4
v4.0.0-alpha.5
v4.0.0-beta.0
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.1
v4.1.0
v4.1.1
v4.10.0
v4.10.1
v4.10.2
v4.11.0
v4.11.1
v4.12.0
v4.12.1
v4.12.2
v4.13.0
v4.14.0
v4.15.0
v4.15.1
v4.16.0
v4.16.1
v4.16.2
v4.16.3
v4.16.4
v4.16.5
v4.17.0
v4.17.1
v4.17.2
v4.17.3
v4.18.0
v4.18.1
v4.19.0
v4.19.1
v4.2.0
v4.20.0
v4.20.1
v4.20.2
v4.21.0
v4.22.0
v4.23.0
v4.23.1
v4.24.0
v4.25.0
v4.25.1
v4.26.0
v4.26.1
v4.27.0
v4.27.1
v4.28.0
v4.28.1
v4.28.2
v4.28.3
v4.28.4
v4.29.0
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.3.0
v4.30.0
v4.31.0
v4.32.0
v4.32.1
v4.32.2
v4.33.0
v4.34.0
v4.35.0
v4.35.1
v4.35.2
v4.35.3
v4.36.0
v4.36.1
v4.37.0
v4.38.0
v4.39.0
v4.39.1
v4.39.2
v4.39.3
v4.4.0
v4.4.1
v4.40.0
v4.40.1
v4.40.2
v4.40.3
v4.41.0
v4.41.1
v4.41.2
v4.41.3
v4.41.4
v4.41.5
v4.41.6
v4.42.0
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v4.8.1
v4.8.2
v4.8.3
v4.9.0
v4.9.1
v4.9.2
v5.*
v5.0.0
v5.0.0-alpha.0
v5.0.0-alpha.1
v5.0.0-alpha.10
v5.0.0-alpha.11
v5.0.0-alpha.12
v5.0.0-alpha.13
v5.0.0-alpha.14
v5.0.0-alpha.15
v5.0.0-alpha.16
v5.0.0-alpha.17
v5.0.0-alpha.18
v5.0.0-alpha.19
v5.0.0-alpha.2
v5.0.0-alpha.20
v5.0.0-alpha.21
v5.0.0-alpha.22
v5.0.0-alpha.23
v5.0.0-alpha.24
v5.0.0-alpha.25
v5.0.0-alpha.26
v5.0.0-alpha.27
v5.0.0-alpha.28
v5.0.0-alpha.29
v5.0.0-alpha.3
v5.0.0-alpha.30
v5.0.0-alpha.31
v5.0.0-alpha.32
v5.0.0-alpha.4
v5.0.0-alpha.5
v5.0.0-alpha.6
v5.0.0-alpha.7
v5.0.0-alpha.8
v5.0.0-alpha.9
v5.0.0-beta.0
v5.0.0-beta.1
v5.0.0-beta.10
v5.0.0-beta.11
v5.0.0-beta.12
v5.0.0-beta.13
v5.0.0-beta.14
v5.0.0-beta.15
v5.0.0-beta.16
v5.0.0-beta.17
v5.0.0-beta.18
v5.0.0-beta.19
v5.0.0-beta.2
v5.0.0-beta.20
v5.0.0-beta.21
v5.0.0-beta.22
v5.0.0-beta.23
v5.0.0-beta.24
v5.0.0-beta.25
v5.0.0-beta.26
v5.0.0-beta.27
v5.0.0-beta.28
v5.0.0-beta.29
v5.0.0-beta.3
v5.0.0-beta.30
v5.0.0-beta.31
v5.0.0-beta.32
v5.0.0-beta.33
v5.0.0-beta.4
v5.0.0-beta.5
v5.0.0-beta.6
v5.0.0-beta.7
v5.0.0-beta.8
v5.0.0-beta.9
v5.0.0-rc.0
v5.0.0-rc.1
v5.0.0-rc.2
v5.0.0-rc.3
v5.0.0-rc.4
v5.0.0-rc.5
v5.0.0-rc.6
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.10.0
v5.10.1
v5.10.2
v5.10.3
v5.11.0
v5.11.1
v5.12.0
v5.12.1
v5.12.2
v5.12.3
v5.13.0
v5.14.0
v5.15.0
v5.16.0
v5.17.0
v5.18.0
v5.19.0
v5.2.0
v5.2.1
v5.20.0
v5.20.1
v5.20.2
v5.21.0
v5.21.2
v5.22.0
v5.23.0
v5.24.0
v5.24.1
v5.24.2
v5.24.3
v5.24.4
v5.25.0
v5.25.1
v5.26.0
v5.26.1
v5.26.2
v5.26.3
v5.27.0
v5.27.1
v5.27.2
v5.28.0
v5.29.0
v5.3.0
v5.3.1
v5.3.2
v5.30.0
v5.31.0
v5.31.1
v5.31.2
v5.32.0
v5.33.0
v5.33.1
v5.33.2
v5.34.0
v5.35.0
v5.35.1
v5.36.0
v5.36.1
v5.36.2
v5.37.0
v5.37.1
v5.38.0
v5.38.1
v5.39.0
v5.39.1
v5.4.0
v5.40.0
v5.41.0
v5.41.1
v5.42.0
v5.42.1
v5.43.0
v5.44.0
v5.45.0
v5.45.1
v5.46.0
v5.47.0
v5.47.1
v5.48.0
v5.49.0
v5.5.0
v5.5.1
v5.50.0
v5.51.0
v5.51.1
v5.51.2
v5.52.0
v5.52.1
v5.53.0
v5.54.0
v5.55.0
v5.55.1
v5.56.0
v5.56.1
v5.57.0
v5.57.1
v5.58.0
v5.58.1
v5.58.2
v5.59.0
v5.59.1
v5.6.0
v5.60.0
v5.61.0
v5.62.0
v5.62.1
v5.62.2
v5.63.0
v5.64.0
v5.64.1
v5.64.2
v5.64.3
v5.64.4
v5.65.0
v5.66.0
v5.67.0
v5.68.0
v5.69.0
v5.69.1
v5.7.0
v5.70.0
v5.71.0
v5.72.0
v5.72.1
v5.73.0
v5.74.0
v5.75.0
v5.76.0
v5.76.1
v5.76.2
v5.76.3
v5.77.0
v5.78.0
v5.79.0
v5.8.0
v5.80.0
v5.81.0
v5.82.0
v5.82.1
v5.83.0
v5.83.1
v5.84.0
v5.84.1
v5.85.0
v5.85.1
v5.86.0
v5.87.0
v5.88.0
v5.88.1
v5.88.2
v5.89.0
v5.9.0
v5.90.0
v5.90.1
v5.90.2
v5.90.3
v5.91.0
v5.92.0
v5.92.1
v5.93.0