Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2023-25572
Good to know:
Date: February 13, 2023
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the "<RichTextField>" are affected. "<RichTextField>" outputs the field value using "dangerouslySetInnerHTML" without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use "DOMPurify" to escape the HTML before outputting it with React and "dangerouslySetInnerHTML". Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the "<RichTextField>" by a custom field doing sanitization by hand.
Language: TYPE_SCRIPT
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79Top Fix
Upgrade Version
Upgrade to version react-admin - 4.7.6;react-admin - 3.19.12;ra-ui-materialui - 4.7.6;ra-ui-materialui - 3.19.12
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | REQUIRED |
| Scope (S): | CHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | LOW |
| Availability (A): | NONE |