{"id":"CVE-2019-10771","aliases":["EUVD-2019-0781","GHSA-6rjc-4pwr-3vp7"],"status":"published","title":"Cross-Site Scripting in iobroker.web","description":"Characters in the GET url path are not properly escaped and can be reflected in the server response.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00679,"percentile":0.52632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-11-25T22:39:39Z","modified":"2026-06-17T02:11:38Z","fixes":[{"ecosystem":"npm","package":"iobroker.web","fixed_in":["2.4.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"iobroker.web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10"}]}]},{"source":"osv","ecosystem":"npm","package":"iobroker.web","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.10"}]}]}],"products":[{"vendor":"iobroker","product":"iobroker.web"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10771","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1345","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6rjc-4pwr-3vp7"}],"sources":{"cve":[{"id":"CVE-2019-10771","description":"Characters in the GET url path are not properly escaped and can be reflected in the server response.","status":"published","published":"2019-11-25T22:39:39Z","modified":"2024-08-04T22:32:01.665Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-0781","description":"Characters in the GET url path are not properly escaped and can be reflected in the server response.","status":"published","published":"2019-11-25T22:39:39Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.198112Z"}],"ghsa":[{"id":"GHSA-6rjc-4pwr-3vp7","title":"Cross-Site Scripting in iobroker.web","description":"Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.4.10 or later.","status":"published","published":"2019-12-02T18:14:30Z","modified":"2023-01-09T05:01:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2019-10771","description":"Characters in the GET url path are not properly escaped and can be reflected in the server response.","status":"published","published":"2019-11-25T23:15:10.93Z","modified":"2026-06-17T02:11:38.483Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"GHSA-6rjc-4pwr-3vp7","title":"Cross-Site Scripting in iobroker.web","description":"Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.4.10 or later.","status":"published","published":"2019-12-02T18:14:30Z","modified":"2026-03-13T22:11:06.874886Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}