Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to     a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g.,     `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site     scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with     an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the     vulnerability. (CVE-2024-47068)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to
    a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g.,
    `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site
    scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with
    an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the
    vulnerability. (CVE-2024-47068)

ID	Name	Product	Family	Severity
228788	Linux Distros Unpatched Vulnerability : CVE-2024-47068	Nessus	Misc.	medium
415075	SCA: security update for rollup (GHSA-gcx4-mw62-g8wm)	Tenable Cloud Security	SCA Checks	high
415075	SCA: security update for rollup (GHSA-gcx4-mw62-g8wm)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-47068

high

Tenable Plugins

medium

high

high