CVE-2022-24762
sysend.js is a library that allows a user to send messages between pages that are open in the same browser.
Does this matter?
Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.
Description
sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.68% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-346
- Affected
- sysend.js project/sysend.js
- Source
- security-advisories@github.com
References
- https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431aPatch, Third Party Advisory
- https://github.com/jcubic/sysend.js/issues/33Exploit, Issue Tracking, Third Party Advisory
- https://github.com/jcubic/sysend.js/releases/tag/1.10.0Release Notes, Third Party Advisory
- https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqcThird Party Advisory
- https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431aPatch, Third Party Advisory
- https://github.com/jcubic/sysend.js/issues/33Exploit, Issue Tracking, Third Party Advisory
- https://github.com/jcubic/sysend.js/releases/tag/1.10.0Release Notes, Third Party Advisory
- https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqcThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.