6.4

CVE-2024-43788: webpack Cross-site Scripting

CVSS: 6.4v3.1MediumModified
AliasesUBUNTU-CVE-2024-43788DEBIAN-CVE-2024-43788CGA-2r2w-g73f-xvgg
Published 27-08-2024Last modified 09-01-2025
Open JSON

Vulnerability summary

CVE-2024-43788 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in webpack. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 60.8% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.96%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3github, reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 7
SUSE-SU-2024:3771-1CGA-37CX-X4M9-C75FCGA-9RJF-F92Q-2CM7CGA-H43V-8HRP-CPGCCGA-V955-45J8-9W79CVE-2024-45389

Timeline

  1. 27-08-2024
    PublishedVulnerability first disclosed.
  2. 09-01-2025
    Last modifiedVulnerability information updated.

Description

Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

0.96%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

0.00 pp

From 0.96% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.96%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • githubUnverified

    Webpack

    Maturity: poc

  • referenceUnverified

    Exploit Reference (research.securitum.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (scnps.co)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard13 products
  • arangodb-3.11< 3.11.14.5-r19
  • arangodb-3.12< 3.12.9.4-r34
  • argo-workflows< 3.6.0-r0
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
Wolfi11 products
  • argo-workflows< 3.6.0-r0
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
Opensuse2 products
  • forgejo&distro=openSUSE Tumbleweed< 8.0.3-1.1
  • rollup&distro=openSUSE Tumbleweed< 3.29.5-1.1
Debian1 product
  • node-webpackAll versions (No fix recorded) | < 5.94.0+dfsg1+~cs11.18.26-2
Npm1 product
  • webpack≥ 5.0.0-alpha.0, < 5.94.0
Ubuntu1 product
  • node-webpackAll versions (No fix recorded)
Webpack1 product
Webpack.js1 product

8 vendors · 31 products

References

12 links
Show all 12 references