CVE-2021-35440 Smashing Cross-site Scripting vulnerability
Attackers can execute JavaScript via crafted widget URLs to steal session data and private information from victims using the Smashing library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-35440?
CVE-2021-35440 is a medium-severity cross-site scripting vulnerability in n/a, published on 6 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL's for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.
Weakness: CWE-79
Which versions are affected by CVE-2021-35440?
2 open source packages ship an affected version, including smashing. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
smashing RubyGems | All versions | 1.3.5 |
smashing RubyGems | All versions | 1.3.5 |
Products include Smashing Project Smashing.
How do I fix CVE-2021-35440?
Upgrade smashing to 1.3.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-35440 being exploited?
There is no known exploitation of CVE-2021-35440 in the wild and no public exploit code.
Sources
Also known as GHSA-254j-mmc5-qhpx.