Cross-site scripting in Webpack - CVE-2024-43788

Vulnerability identifier: #VU96642

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-43788

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in AutoPublicPathRuntimeModule. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Webpack
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
Event Processing
Platform UI in IBM Cloud Pak for Integration (CP4I)
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
QRadar Log Source Management App
IBM Concert Software
Cryostat
IBM Observability with Instana
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Cloud Pak for Security
IBM Fusion HCI
QRadar User Behavior Analytics
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Network Observability plugin for the Openshift Console
Migration Toolkit for Containers
JBoss Data Grid
IBM Cognos Controller
pgadmin4-web-uwsgi
pgadmin4
pgadmin4-cloud
pgadmin4-doc
system-user-pgadmin
pgadmin4-desktop

Install update from vendor's website.

Webpack - update to 5.94.0
Event Processing - update to 1.2.1
IBM Concert Software - update to 2.0.0
IBM Observability with Instana - update to 286
Red Hat OpenShift Serverless - update to 1
Network Observability plugin for the Openshift Console - update to 1.7.0
Migration Toolkit for Containers - update to 1.8.5
IBM Cloud Pak for Security - update to 1.11.2.0
OpenShift Service Mesh - addressed in versions 2.4.11, 2.5.5, 2.6.2
IBM Fusion HCI - update to 2.9.0
QRadar User Behavior Analytics - update to 4.1.17
DB2 on Cloud Pak for Data - update to 4.8.8
DB2 Warehouse on Cloud Pak for Data - update to 4.8.8
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.16.3, 4.17.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
watsonx Assistant Cartridge - update to 5.1.3
QRadar Log Source Management App - update to 7.0.11
JBoss Data Grid - update to 8.5.2
pgadmin4-web-uwsgi - update to 8.5-150600.3.6.1
pgadmin4 - update to 8.5-150600.3.6.1
pgadmin4-cloud - update to 8.5-150600.3.6.1
pgadmin4-doc - update to 8.5-150600.3.6.1
system-user-pgadmin - update to 8.5-150600.3.6.1
pgadmin4-desktop - update to 8.5-150600.3.6.1
IBM Cognos Controller - addressed in versions 11.0.1 FP7, 11.1.2 FP1

• https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
• https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
• https://research.securitum.com/xss-in-amp4email-dom-clobbering
• https://scnps.co/papers/sp23_domclob.pdf

• Cross-site scripting in Webpack
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.6
• Multiple vulnerabilities in Red Hat build of Cryostat 3 on RHEL 8
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.7
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• SUSE update for pgadmin4
• IBM Event Processing update for Webpack
• Multiple vulnerabilities in JBoss Data Grid 8.5
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Observability with Instana
• Platform UI and Automation Assets in IBM Cloud Pak for Integration update for Webpack and Rspack
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Security
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for Webpack and Rspack
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Controller