Medium severity · published Feb 24, 2023
CVE-2022-48345
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Braintree/sanitize-url · Paypal
before 6.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-48345
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-48345
Patch
https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c
Patch
https://github.com/braintree/sanitize-url/compare/v6.0.1...v6.0.2
More from Braintree/sanitize-url
6.1
CVE-2021-23648
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function