CVE-2024-11831 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.4
cpes: cpe:/a:redhat:advanced_cluster_security:4.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.5
cpes: cpe:/a:redhat:advanced_cluster_security:4.5::el8
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 7.1
cpes: cpe:/a:redhat:ceph_storage:7.1::el8
cpe:/a:redhat:ceph_storage:7.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 8.1
cpes: cpe:/a:redhat:ceph_storage:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 9.0
cpes: cpe:/a:redhat:ceph_storage:9.0::el10
cpe:/a:redhat:ceph_storage:9.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: RHODF-4.14-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.14::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.14-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.14::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.14-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.14::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.15-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.15::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.15-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.15::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.15-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.15::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.16-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.16::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.16-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.16::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.16-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.16::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.17-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.17::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.17-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.17::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.17-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.17::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.18-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.18::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.18-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.18::el9
default_status: affected
vendor: Red Hat
product: RHODF-4.18-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 8
cpes: cpe:/a:redhat:ceph_storage:8::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 9.0
cpes: cpe:/a:redhat:ceph_storage:9.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.14.6
cpes: cpe:/a:redhat:openshift_pipelines:1.14::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.15
cpes: cpe:/a:redhat:openshift_pipelines:1.15::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.15
cpes: cpe:/a:redhat:openshift_pipelines:1.15::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.16
cpes: cpe:/a:redhat:openshift_pipelines:1.16::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.16
cpes: cpe:/a:redhat:openshift_pipelines:1.16::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.17
cpes: cpe:/a:redhat:openshift_pipelines:1.17::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.17
cpes: cpe:/a:redhat:openshift_pipelines:1.17::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.18.0
cpes: cpe:/a:redhat:openshift_pipelines:1.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Pipelines 1.19
cpes: cpe:/a:redhat:openshift_pipelines:1.19::el9
default_status: affected
vendor: Red Hat
product: Cryostat 3
cpes: cpe:/a:redhat:cryostat:3
default_status: affected
vendor: Red Hat
product: Logging Subsystem for Red Hat OpenShift
cpes: cpe:/a:redhat:logging:5
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Virtualization
cpes: cpe:/a:redhat:migration_toolkit_virtualization:2
default_status: unaffected
vendor: Red Hat
product: .NET 6.0 on Red Hat Enterprise Linux
cpes: cpe:/a:redhat:rhel_dotnet:6.0
default_status: unknown
vendor: Red Hat
product: OpenShift Lightspeed
cpes: cpe:/a:redhat:openshift_lightspeed
default_status: affected
vendor: Red Hat
product: OpenShift Pipelines
cpes: cpe:/a:redhat:openshift_pipelines:1
default_status: affected
vendor: Red Hat
product: OpenShift Pipelines
cpes: cpe:/a:redhat:openshift_pipelines:1
default_status: affected
vendor: Red Hat
product: OpenShift Pipelines
cpes: cpe:/a:redhat:openshift_pipelines:1
default_status: affected
vendor: Red Hat
product: OpenShift Serverless
cpes: cpe:/a:redhat:serverless:1
default_status: affected
vendor: Red Hat
product: OpenShift Service Mesh 2
cpes: cpe:/a:redhat:service_mesh:2
default_status: affected
vendor: Red Hat
product: OpenShift Service Mesh 2
cpes: cpe:/a:redhat:service_mesh:2
default_status: affected
vendor: Red Hat
product: Red Hat 3scale API Management Platform 2
cpes: cpe:/a:redhat:red_hat_3scale_amp:2
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: unaffected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4
cpes: cpe:/a:redhat:advanced_cluster_security:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4
cpes: cpe:/a:redhat:advanced_cluster_security:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4
cpes: cpe:/a:redhat:advanced_cluster_security:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4
cpes: cpe:/a:redhat:advanced_cluster_security:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4
cpes: cpe:/a:redhat:advanced_cluster_security:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: unaffected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
cpes: cpe:/a:redhat:ansible_automation_platform:2
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel - HawtIO 4
cpes: cpe:/a:redhat:apache_camel_hawtio:4
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apicurio Registry 2
cpes: cpe:/a:redhat:service_registry:2
default_status: affected
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
cpes: cpe:/a:redhat:optaplanner:::el6
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 7
cpes: cpe:/a:redhat:ceph_storage:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Ceph Storage 7
cpes: cpe:/a:redhat:ceph_storage:7
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 7
cpes: cpe:/a:redhat:ceph_storage:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Ceph Storage 8
cpes: cpe:/a:redhat:ceph_storage:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Ceph Storage 8
cpes: cpe:/a:redhat:ceph_storage:8
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 9
cpes: cpe:/a:redhat:ceph_storage:9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 9
cpes: cpe:/a:redhat:ceph_storage:9
default_status: affected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat Developer Hub
cpes: cpe:/a:redhat:rhdh:1
default_status: unaffected
vendor: Red Hat
product: Red Hat Discovery 1
cpes: cpe:/a:redhat:discovery:1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: affected
vendor: Red Hat
product: Red Hat Integration Camel K 1
cpes: cpe:/a:redhat:integration:1
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 3.11
cpes: cpe:/a:redhat:openshift:3.11
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
cpes: cpe:/a:redhat:openshift_devspaces:3
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
cpes: cpe:/a:redhat:openshift_devspaces:3
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
cpes: cpe:/a:redhat:openshift_devspaces:3
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift distributed tracing 3
cpes: cpe:/a:redhat:openshift_distributed_tracing:3
default_status: affected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Quay 3
cpes: cpe:/a:redhat:quay:3
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
vendor: Red Hat
product: Red Hat Trusted Profile Analyzer
cpes: cpe:/a:redhat:trusted_profile_analyzer:1
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-02-10T15:27:46.732Z