ByteOS Network

NVD Vulnerability Details :

CVE-2020-15262

Analyzed

Source-security-advisories@github.com

Published At-19 Oct, 2020 | 20:15

Updated At-18 Nov, 2021 | 16:19

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Secondary	3.1	3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

webpack-subresource-integrity_project>>webpack-subresource-integrity>>Versions before 1.5.1(exclusive)

cpe:2.3:a:webpack-subresource-integrity_project:webpack-subresource-integrity:*:*:*:*:*:node.js:*:*

Weaknesses

CWE ID	Type	Source
CWE-345	Primary	nvd@nist.gov
CWE-345	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f	security-advisories@github.com	Patch Third Party Advisory
https://github.com/waysact/webpack-subresource-integrity/issues/131	security-advisories@github.com	Third Party Advisory
https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh	security-advisories@github.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History