CVE-2018-6341 Information

Description

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x 16.1.x 16.2.x 16.3.x and 16.4.x. It was fixed in 16.0.1 16.1.2 16.2.1 16.3.3 and 16.4.2.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html https://twitter.com/reactjs/status/1024745321987887104

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1