CVE-2014-0013

Published: Feb 15, 2018Modified: Nov 21, 2024

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.

Affected (38)

Products: Emberjs: Ember.js

Emberjs

1 product

Ember.js

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Emberjs Ember.js	Version 1.0.0
Emberjs Ember.js	Version 1.0.0 pre.2
Emberjs Ember.js	Version 1.0.0 pre.3
Emberjs Ember.js	Version 1.0.0 pre.4
Emberjs Ember.js	Version 1.0.0 rc.1.1
Emberjs Ember.js	Version 1.0.0 rc.1
Emberjs Ember.js	Version 1.0.0 rc.2.1
Emberjs Ember.js	Version 1.0.0 rc.2
Emberjs Ember.js	Version 1.0.0 rc.3.1
Emberjs Ember.js	Version 1.0.0 rc.3
Emberjs Ember.js	Version 1.0.0 rc.4.1
Emberjs Ember.js	Version 1.0.0 rc.4
Emberjs Ember.js	Version 1.0.0 rc.5.1
Emberjs Ember.js	Version 1.0.0 rc.5
Emberjs Ember.js	Version 1.0.0 rc.6.1
Emberjs Ember.js	Version 1.0.0 rc.6
Emberjs Ember.js	Version 1.0.0 rc.7
Emberjs Ember.js	Version 1.0.0 rc.8
Emberjs Ember.js	Version 1.0.0 rc4
Emberjs Ember.js	Version 1.1.0
Emberjs Ember.js	Version 1.1.0 beta.1
Emberjs Ember.js	Version 1.1.0 beta.2
Emberjs Ember.js	Version 1.1.0 beta.3
Emberjs Ember.js	Version 1.1.0 beta.4
Emberjs Ember.js	Version 1.1.1
Emberjs Ember.js	Version 1.1.2
Emberjs Ember.js	Version 1.2.0
Emberjs Ember.js	Version 1.2.0 beta.1
Emberjs Ember.js	Version 1.2.0 beta.2
Emberjs Ember.js	Version 1.2.0 beta.3
Emberjs Ember.js	Version 1.2.0 beta.4
Emberjs Ember.js	Version 1.3.0
Emberjs Ember.js	Version 1.3.0 beta.1
Emberjs Ember.js	Version 1.3.0 beta.2
Emberjs Ember.js	Version 1.3.0 beta.3
Emberjs Ember.js	Version 1.3.0 beta.4
Emberjs Ember.js	Version 1.4.0
Emberjs Ember.js	Version 1.4.0 beta.1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://emberjs.com/blog/2014/01/14/ember-security-releases.html

Source: secalert@redhat.com

Vendor Advisory

https://groups.google.com/forum/#%21topic/ember-security/2kpXXCxISS4

Source: secalert@redhat.com

http://emberjs.com/blog/2014/01/14/ember-security-releases.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://groups.google.com/forum/#%21topic/ember-security/2kpXXCxISS4

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.