Detections
Analytics

SCA: security update for webpack (GHSA-4vvj-4cpr-p986)

medium Tenable Self-Hosted Container Security Plugin ID 410422

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it
 is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack
 developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The
 DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless
 attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.
 Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to
 happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering
 is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign
 HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code)
 living in the existing javascript code to transform it into executable code. This vulnerability can lead
 to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject
 certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been
 addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for
 this issue. (CVE-2024-43788)

See Also

https://github.com/advisories/GHSA-4vvj-4cpr-p986

Plugin Details

Severity: Medium

ID: 410422

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-43788

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.1

Threat Score: 5.6

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/27/2024

Vulnerability Publication Date: 8/27/2024

Reference Information

CVE: CVE-2024-43788

cwe: CWE-79