Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-4243

CVE-2021-4243: Duplicate advisory: @claviska/jquery-minicolors vulnerable to Cross-site Scripting

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-4243
GHSA ID
GHSA-vc9x-gmmr-p7jj
EPSS Score
-
CWE
CWE-79
Published
12/12/2022
Updated
2/22/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
@claviska/jquery-minicolorsnpm< 2.3.62.3.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsafe string concatenation in swatch creation code shown in both the GitHub Security Lab advisory and the patch commit. The original code used '<span ... title="' + name + '">' which allowed HTML injection. The patch moved the title to a separate .attr() call which would enable proper escaping. The file path and attack vector are explicitly identified in multiple sources including the GHSL advisory and NVD references.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## *upli**t* **visory T*is **visory **s ***n wit**r*wn ****us* it is * *upli**t* o* [**S*-*r**-vv*v-***q](*ttps://*it*u*.*om/**visori*s/**S*-*r**-vv*v-***q). T*is link is m*int*in** to pr*s*rv* *xt*rn*l r***r*n**s. ## Ori*in*l **s*ription * vuln*r**

Reasoning

T** vuln*r**ility st*ms *rom uns*** strin* *on**t*n*tion in sw*t** *r**tion *o** s*own in *ot* t** *it*u* S**urity L** **visory *n* t** p*t** *ommit. T** ori*in*l *o** us** `'<sp*n ... titl*="' + n*m* + '">'` w*i** *llow** *TML inj**tion. T** p*t** m