CERTCC cveClient Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the cveInterface.js file of the CERTCC cveClient. This issue arises because the cveInterface component trusts and directly displays HTML input received from CVE API services, creating an opportunity for malicious HTML injection.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to the latest version of the cveClient, where this vulnerability has been addressed. Instructions for downloading and installing the updated version are available in the project's INSTALL.md file.