2 lines
4.1 KiB
JSON
2 lines
4.1 KiB
JSON
{"affected":[{"affectedData":[{"product":"mailparser","vendor":"n/a","versions":[{"lessThan":"3.9.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"report@snyk.io"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nodemailer:mailparser:*:*:*:*:*:node.js:*:*","matchCriteriaId":"E9F4D3A2-A90E-4385-86F6-FBB3262FFB5E","versionEndExcluding":"3.9.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote \" to the URL with embedded malicious JavaScript code."},{"lang":"es","value":"Las versiones del paquete mailparser anteriores a la 3.9.3 son vulnerables a cross-site scripting (XSS) a través de la función textToHtml() debido a la sanitización incorrecta de las URL en el contenido del correo electrónico. Un atacante puede ejecutar scripts arbitrarios en los navegadores de las víctimas al añadir una comilla extra ' a la URL con código JavaScript malicioso incrustado."}],"id":"CVE-2026-3455","lastModified":"2026-06-17T10:43:36.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"report@snyk.io","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"report@snyk.io","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3455","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-03T15:07:11.759930Z","version":"2.0.3"}}]},"published":"2026-03-03T05:17:25.240","references":[{"source":"report@snyk.io","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a"},{"source":"report@snyk.io","tags":["Patch"],"url":"https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08"},{"source":"report@snyk.io","tags":["Issue Tracking"],"url":"https://github.com/nodemailer/mailparser/issues/412"},{"source":"report@snyk.io","tags":["Third Party Advisory"],"url":"https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032"}],"sourceIdentifier":"report@snyk.io","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"report@snyk.io","type":"Secondary"}]}
|