Threat Investigation
Request a demo

CVE-2022-24709

High

Description

@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Users are advised to upgrade to version 3.0.367 or later. There are no known workarounds for this issue.

SeverityHigh
CVSS8.8
Exploit probability53. percentile0.7%
Product@awsui/components-react
PublishedFeb 24, 2022
First seenFeb 24, 2022
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • @awsui/components-react3.0.367 or later
  • amazon awsui\/components-react3.0.367 or later

Affected products

ProductAffected versionsFixed in
@awsui/components-reactnpmv < 3.0.3673.0.367
amazon awsui\/components-reactv < 3.0.3673.0.367

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.