CVE-2018-6341

moderate-risk

Published 2018-12-31

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

Do I need to act?

10.6% chance of exploitation in next 30 days

EPSS score — higher than 89% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (1)

React

Affected Vendors

Facebook

References (4)

Vendor Advisory https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html

Vendor Advisory https://twitter.com/reactjs/status/1024745321987887104

Vendor Advisory https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html

Vendor Advisory https://twitter.com/reactjs/status/1024745321987887104

/ 100

moderate-risk

Severity 23/34 · High

Exploitability 11/34 · Low

Exposure 5/34 · Minimal