GHSA-pvc3-wvxr-7cmf

SmallRye Health UI Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3914

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.smallrye:smallrye-health-ui	< 3.1.2	3.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3914 advisory
https://github.com/smallrye/smallrye-health/pull/333 web
https://github.com/smallrye/smallrye-health/commit/01b25a038824887363cd413d8cd14052f5fc3541 web
https://github.com/smallrye/smallrye-health/commit/47a33f19f5bb1e4216a15f3aee6ca3b1e2ccba59 web
https://access.redhat.com/security/cve/CVE-2021-3914 web
https://bugzilla.redhat.com/show_bug.cgi?id=2018015 web
https://github.com/smallrye/smallrye-health package