CVE-2022-24762
Medium
Description
sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.
SeverityMedium
CVSS6.5
Exploit probability—
ProductSysend.js
PublishedMar 14, 2022
First seenMar 14, 2022
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- sysend.js_project sysend.js1.10.0 or later
- sysend1.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sysend.js_project sysend.js | v < 1.10.0 | 1.10.0 |
| sysendnpm | v < 1.10.0 | 1.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.