CVE-2013-4170
- State
- Published
- Severity
- Not scored
- Published
- Jun 30, 2022
- Updated
- Aug 6, 2024
- Reserved
- Jun 12, 2013
Description
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ember-sourcen/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.