Skip to content
fr Sign in
5.4 Medium

CVE-2024-11831 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Security 4.4 4.4 earliest → < 4.4.8-2 4.4.8-2
Red Hat Advanced Cluster Security 4.5 4.5 earliest → < 4.5.6-2 4.5.6-2
Red Hat Ceph Storage 8.1 1787550654 earliest → < 1787550654 1787550654
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
RHODF-4.14-RHEL-9 4.14 earliest → < 4.14.18-2 4.14.18-2
RHODF-4.15-RHEL-9 4.15 earliest → < 4.15.14-2 4.15.14-2
RHODF-4.16-RHEL-9 4.16 earliest → < 4.16.10-3 4.16.10-3
RHODF-4.17-RHEL-9 4.17 earliest → < 4.17.7-2 4.17.7-2
Show the 49 other branches
Product Affected versions Fixed in
RHODF-4.18-RHEL-9 4.18 earliest → < 4.18.2-8 4.18.2-8
Red Hat Ceph Storage 8 Versions not published
Red Hat OpenShift Pipelines 1.14.6 1.14 earliest → < 1.14.6-1744143767 1.14.6-1744143767
Red Hat OpenShift Pipelines 1.15 1.15 earliest → < 1.15.3-1746936251 1.15.3-1746936251
Red Hat OpenShift Pipelines 1.16 1.16 earliest → < 1.16.4-1747979846 1.16.4-1747979846
Red Hat OpenShift Pipelines 1.17 1.17 earliest → < 1.17.2-1750066936 1.17.2-1750066936
Red Hat OpenShift Pipelines 1.18 1.18 earliest → < 1.18.1-1747749913 1.18.1-1747749913
Red Hat OpenShift Pipelines 1.19 1.19 earliest → < 1.19.0-1752127853 1.19.0-1752127853
Cryostat 3 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Migration Toolkit for Virtualization Versions not published
.NET 6.0 on Red Hat Enterprise Linux Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
OpenShift Service Mesh 2 Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Ceph Storage 7 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Discovery 1 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Integration Camel K 1 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 3.11 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Trusted Profile Analyzer Versions not published
Red Hat OpenShift Pipelines 1.18.0 1.18 earliest → < 1.18.1-1747749913 1.18.1-1747749913
Red Hat Ceph Storage 9.0 1776359884 earliest → < 1776359884 1776359884
Red Hat Ceph Storage 7.1 1791452477 earliest → < 1791452477 1791452477
Red Hat In-Vehicle Operating System 1 Versions not published
Red Hat Developer Hub 1 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Security 4.4

The 2 CVEs of Red Hat Advanced Cluster Security 4.4 →
CVE-2024-3727 Containers/image: digest type does not guarantee valid type 8.3 High
Track this CVE