Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-3773

CVE-2018-3773: metascraper before v5.2.0 vulnerable to stored cross-site scripting

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-3773
GHSA ID
GHSA-8f64-q7jc-ccgp
EPSS Score
0.62689%
CWE
CWE-79
Published
8/8/2018
Updated
1/31/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
metascrapernpm< 5.2.05.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing HTML escaping in metadata extraction. The patch (PR#169) introduced an 'escape' parameter that applies HTML entity escaping by default. Since the advisory specifies stored XSS via Open Graph properties and the fix involved adding escaping to metadata values, the core vulnerability exists in functions responsible for returning raw metadata values without sanitization. While exact function names/paths aren't specified in available data, the pattern of changes in the pull request indicates the vulnerability was present across multiple metadata extraction rules.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

V*rsions o* `m*t*s*r*p*r` prior to *.*.* *r* vuln*r**l* to stor** *ross-sit* s*riptin* (XSS). ## R**omm*n**tion Up*r*** to v*rsion *.*.* or l*t*r.

Reasoning

T** vuln*r**ility st*ms *rom missin* *TML *s**pin* in m*t***t* *xtr**tion. T** p*t** (PR#***) intro*u*** *n '*s**p*' p*r*m*t*r t**t *ppli*s *TML *ntity *s**pin* *y ****ult. Sin** t** **visory sp**i*i*s stor** XSS vi* Op*n *r*p* prop*rti*s *n* t** *ix