Cross-site Scripting (XSS) Affecting rethinkdb package, versions <2.1.0 >=1.2.0


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDnpm:rethinkdb:20150514
  • published13 Mar 2017
  • disclosed13 May 2015
  • creditDaniel Mewes

Introduced: 13 May 2015

CVE NOT AVAILABLE CWE-79  (opens in a new tab)

How to fix?

Upgrade rethinkdb to version 2.1.0 or higher.

Overview

rethinkdb provides the JavaScript driver library for the RethinkDB database server for use in your node application.

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) due to using a non-cryptographic hash map to store connection IDs, making it possible to easily guess the connection ID. Attackers can use this ID to run queries on the connection setup.

Details

<>

References

CVSS Scores

version 3.1