XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.
References
Link | Resource |
---|---|
https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045 | Patch Vendor Advisory |
https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612 | Exploit Vendor Advisory |
https://www.debian.org/security/2022/dsa-5042 | Third Party Advisory |
Information
Published : 2021-12-15 19:15
Updated : 2022-01-21 06:47
NVD link : CVE-2021-45086
Mitre link : CVE-2021-45086
JSON object : View
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Products Affected
debian
- debian_linux
gnome
- epiphany