In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
References
| Link | Resource |
|---|---|
| https://groups.google.com/g/ember-security/c/dokLVwwxAdM | Mailing List Patch Third Party Advisory |
| https://rubysec.com/advisories/CVE-2013-4170/ | Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102 | Patch Third Party Advisory |
| https://groups.google.com/g/ember-security/c/dokLVwwxAdM | Mailing List Patch Third Party Advisory |
| https://rubysec.com/advisories/CVE-2013-4170/ | Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102 | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://groups.google.com/g/ember-security/c/dokLVwwxAdM - Mailing List, Patch, Third Party Advisory | |
| References | () https://rubysec.com/advisories/CVE-2013-4170/ - Third Party Advisory | |
| References | () https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102 - Patch, Third Party Advisory |
09 Jul 2022, 02:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : 2.6
v3 : 6.1 |
| CPE | cpe:2.3:a:emberjs:ember.js:1.0.0:rc2:*:*:*:*:*:* cpe:2.3:a:emberjs:ember.js:1.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:emberjs:ember.js:1.0.0:rc6:*:*:*:*:*:* cpe:2.3:a:emberjs:ember.js:1.0.0:rc4:*:*:*:*:*:* cpe:2.3:a:emberjs:ember.js:1.0.0:rc5:*:*:*:*:*:* cpe:2.3:a:emberjs:ember.js:1.0.0:rc3:*:*:*:*:*:* cpe:2.3:a:emberjs:ember.js:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://groups.google.com/g/ember-security/c/dokLVwwxAdM - Mailing List, Patch, Third Party Advisory | |
| References | (MISC) https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102 - Patch, Third Party Advisory | |
| References | (MISC) https://rubysec.com/advisories/CVE-2013-4170/ - Third Party Advisory |
30 Jun 2022, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-30 13:15
Updated : 2024-11-21 01:55
NVD link : CVE-2013-4170
Mitre link : CVE-2013-4170
CVE.ORG link : CVE-2013-4170
JSON object : View
Products Affected
emberjs
- ember.js
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')