CVE-2022-24709 Cross site scripting in @awsui/components-react
An attacker can inject JavaScript into AWS UI React components due to improper input neutralization, potentially executing code in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-24709?
CVE-2022-24709 is a high-severity cross-site scripting vulnerability in awsui-documentation, published on 24 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Users are advised to upgrade to version 3.0.367 or later. There are no known workarounds for this issue.
Weakness: CWE-79
Which versions are affected by CVE-2022-24709?
2 open source packages ship an affected version, including @awsui/components-react. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@awsui/components-react npm | All versions | 3.0.367 |
@awsui/components-react npm | All versions | 3.0.367 |
Products include Amazon Awsui\/Components-React.
How do I fix CVE-2022-24709?
Upgrade @awsui/components-react to 3.0.367 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-24709 being exploited?
There is no known exploitation of CVE-2022-24709 in the wild and no public exploit code.
Sources
Also known as GHSA-mf22-92pm-m8p8.