Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-x5j5-g553-hudp
Summary
CSRF Vulnerability in jquery-ujs
Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.

When an attacker controls the href attribute of an anchor tag, or
the action attribute of a form tag triggering a POST action, the attacker can set the
href or action to " https://attacker.com". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.


## Recommendation

Upgrade jquery-ujs to version 1.0.4 or later.
Aliases
0
alias GHSA-6qqj-rx4w-r3cj
1
alias GMS-2020-740
Fixed_packages
0
url pkg:npm/jquery-ujs@1.0.4
purl pkg:npm/jquery-ujs@1.0.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/jquery-ujs@1.0.4
Affected_packages
0
url pkg:npm/jquery-ujs@1.0.0
purl pkg:npm/jquery-ujs@1.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-k1jn-jwbx-qya1
1
vulnerability VCID-x5j5-g553-hudp
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/jquery-ujs@1.0.0
1
url pkg:npm/jquery-ujs@1.0.2
purl pkg:npm/jquery-ujs@1.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-k1jn-jwbx-qya1
1
vulnerability VCID-x5j5-g553-hudp
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/jquery-ujs@1.0.2
2
url pkg:npm/jquery-ujs@1.0.3
purl pkg:npm/jquery-ujs@1.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-356q-csk2-8ug5
1
vulnerability VCID-x5j5-g553-hudp
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/jquery-ujs@1.0.3
References
0
reference_url https://groups.google.com/forum/#!msg/rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!msg/rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J
1
reference_url https://hackerone.com/reports/49935
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://hackerone.com/reports/49935
2
reference_url https://snyk.io/vuln/npm:jquery-ujs:20150624
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://snyk.io/vuln/npm:jquery-ujs:20150624
3
reference_url https://www.npmjs.com/advisories/15
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.npmjs.com/advisories/15
4
reference_url https://github.com/advisories/GHSA-6qqj-rx4w-r3cj
reference_id GHSA-6qqj-rx4w-r3cj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6qqj-rx4w-r3cj
Weaknesses
0
cwe_id 352
name Cross-Site Request Forgery (CSRF)
description The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
1
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-x5j5-g553-hudp