Vulnerability-Lookup

CVE-2019-0542 (GCVE-0-2019-0542)

Vulnerability from cvelistv5 – Published: 2019-01-09 15:00 – Updated: 2024-08-04 17:51

Summary

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Assigner

microsoft CNA under the mitre root

CNA scorecard B 82/100 over 3955 records in the last 180 days details

References

6 references

URL	Tags
http://www.securityfocus.com/bid/106434	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHBA-2019:0959	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1422	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2552	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2551	vendor-advisoryx_refsource_REDHAT
https://github.com/xtermjs/xterm.js/releases	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
https://xtermjs.org/	xterm.js	Affected: xterm.js	guessed

Date Public

2019-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:51:26.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106434",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106434"
          },
          {
            "name": "RHBA-2019:0959",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHBA-2019:0959"
          },
          {
            "name": "RHSA-2019:1422",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1422"
          },
          {
            "name": "RHSA-2019:2552",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2552"
          },
          {
            "name": "RHSA-2019:2551",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2551"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/xtermjs/xterm.js/releases"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xterm.js",
          "vendor": "https://xtermjs.org/",
          "versions": [
            {
              "status": "affected",
              "version": "xterm.js"
            }
          ]
        }
      ],
      "datePublic": "2019-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:05:20.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "106434",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106434"
        },
        {
          "name": "RHBA-2019:0959",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2019:0959"
        },
        {
          "name": "RHSA-2019:1422",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1422"
        },
        {
          "name": "RHSA-2019:2552",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2552"
        },
        {
          "name": "RHSA-2019:2551",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2551"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xtermjs/xterm.js/releases"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0542",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xterm.js",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "xterm.js"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "https://xtermjs.org/"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106434",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106434"
            },
            {
              "name": "RHBA-2019:0959",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHBA-2019:0959"
            },
            {
              "name": "RHSA-2019:1422",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1422"
            },
            {
              "name": "RHSA-2019:2552",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2552"
            },
            {
              "name": "RHSA-2019:2551",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2551"
            },
            {
              "name": "https://github.com/xtermjs/xterm.js/releases",
              "refsource": "MISC",
              "url": "https://github.com/xtermjs/xterm.js/releases"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0542",
    "datePublished": "2019-01-09T15:00:00.000Z",
    "dateReserved": "2018-11-26T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:51:26.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-0542",
      "date": "2026-10-15",
      "epss": "0.03166",
      "percentile": "0.87778"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xtermjs:xterm.js:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "174C752A-5862-4B2E-81BF-B33C939F6BA2",
                  "versionEndExcluding": "5.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6F89A265-EBFC-4B1C-8106-B414F815F141",
                  "versionEndExcluding": "3.9.99",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "25B054C0-BCF7-4B0A-9059-3DACA95DE9A1",
                  "versionEndExcluding": "3.10.163",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8D88FD1A-0794-4E79-B51E-91F4403FD1F9",
                  "versionEndExcluding": "3.11.104",
                  "versionStartExcluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
        },
        {
          "lang": "es",
          "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en Xterm.js cuando el componente maneja mal los caracteres especiales, tambi\u00e9n conocida como \"Xterm Remote Code Execution Vulnerability\". Esto afecta a xterm.js"
        }
      ],
      "id": "CVE-2019-0542",
      "lastModified": "2024-11-21T04:16:49.423",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.8,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2019-01-09T15:29:00.213",
      "references": [
        {
          "source": "secure@microsoft.com",
          "url": "http://www.securityfocus.com/bid/106434"
        },
        {
          "source": "secure@microsoft.com",
          "url": "https://access.redhat.com/errata/RHBA-2019:0959"
        },
        {
          "source": "secure@microsoft.com",
          "url": "https://access.redhat.com/errata/RHSA-2019:1422"
        },
        {
          "source": "secure@microsoft.com",
          "url": "https://access.redhat.com/errata/RHSA-2019:2551"
        },
        {
          "source": "secure@microsoft.com",
          "url": "https://access.redhat.com/errata/RHSA-2019:2552"
        },
        {
          "source": "secure@microsoft.com",
          "url": "https://github.com/xtermjs/xterm.js/releases"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securityfocus.com/bid/106434"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHBA-2019:0959"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2019:1422"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2019:2551"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2019:2552"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/xtermjs/xterm.js/releases"
        }
      ],
      "sourceIdentifier": "secure@microsoft.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-94"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:xtermjs:xterm.js:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "174C752A-5862-4B2E-81BF-B33C939F6BA2",
                    "versionEndExcluding": "5.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6F89A265-EBFC-4B1C-8106-B414F815F141",
                    "versionEndExcluding": "3.9.99",
                    "versionStartIncluding": "3.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "25B054C0-BCF7-4B0A-9059-3DACA95DE9A1",
                    "versionEndExcluding": "3.10.163",
                    "versionStartIncluding": "3.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D88FD1A-0794-4E79-B51E-91F4403FD1F9",
                    "versionEndExcluding": "3.11.104",
                    "versionStartExcluding": "3.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
          },
          {
            "lang": "es",
            "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en Xterm.js cuando el componente maneja mal los caracteres especiales, tambi\u00e9n conocida como \"Xterm Remote Code Execution Vulnerability\". Esto afecta a xterm.js"
          }
        ],
        "id": "CVE-2019-0542",
        "lastModified": "2024-11-21T04:16:49.423",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2019-01-09T15:29:00.213",
        "references": [
          {
            "source": "secure@microsoft.com",
            "url": "http://www.securityfocus.com/bid/106434"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://access.redhat.com/errata/RHBA-2019:0959"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://access.redhat.com/errata/RHSA-2019:1422"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://access.redhat.com/errata/RHSA-2019:2551"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://access.redhat.com/errata/RHSA-2019:2552"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://github.com/xtermjs/xterm.js/releases"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/106434"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHBA-2019:0959"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2019:1422"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2019:2551"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2019:2552"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/xtermjs/xterm.js/releases"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-27T01:04:35+00:00",
      "cve": "CVE-2019-0542",
      "id": "CVE-2019-0542",
      "initial_release_date": "2019-01-09T00:00:00+00:00",
      "product_status:fixed": "161",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xterm.js: Mishandling of special characters allows for remote code execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-0542.json",
      "version": "3"
    }
  }
}

BDU:2019-02452 (CVE-2019-0542)

Vulnerability from fstec – Published: 2019-07-11 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость библиотеки Xterm.js, связанная с отсутствием мер по очистке входных данных, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость библиотеки Xterm.js связана с отсутствием мер по очистке входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код

Severity

7.6 (High) CVSS 2.0


                      
                        AV:N/AC:H/Au:N/C:C/I:C/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2019-0542

References

3 references

URL
https://access.redhat.com/security/cve/cve-2019-0542
https://nvd.nist.gov/vuln/detail/cve-2019-0542
https://www.securityfocus.com/bid/106434

Impacted products

2 products from 3 vendors

Vendors

Сообщество свободного программного обеспечения, Red Hat, Inc.

Products

xterm.js, OpenShift Container Platform

Versions

3.10 (xterm.js), 3.9.1 (xterm.js), 3.9 (xterm.js), 3.8 (xterm.js), 3.7 (xterm.js), 3.6 (xterm.js), 3.5.1 (xterm.js), 3.5 (xterm.js), 3.4.1 (xterm.js), 3.4 (xterm.js), 3.11 (OpenShift Container Platform)

Product types

Application software

Mitigations

Обновление программного обеспечения до более поздней версии

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Red Hat, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "3.10 (xterm.js), 3.9.1 (xterm.js), 3.9 (xterm.js), 3.8 (xterm.js), 3.7 (xterm.js), 3.6 (xterm.js), 3.5.1 (xterm.js), 3.5 (xterm.js), 3.4.1 (xterm.js), 3.4 (xterm.js), 3.11 (OpenShift Container Platform)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.01.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "11.07.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-02452",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-0542",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "xterm.js, OpenShift Container Platform",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Xterm.js, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043e\u0447\u0438\u0441\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e  \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Xterm.js \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043e\u0447\u0438\u0441\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://access.redhat.com/security/cve/cve-2019-0542\nhttps://nvd.nist.gov/vuln/detail/cve-2019-0542\nhttps://www.securityfocus.com/bid/106434",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

FKIE_CVE-2019-0542

Vulnerability from fkie_nvd - Published: 2019-01-09 15:29 - Updated: 2026-06-17 02:08

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

References

	URL	Tags
	secure@microsoft.com	http://www.securityfocus.com/bid/106434
	secure@microsoft.com	https://access.redhat.com/errata/RHBA-2019:0959
	secure@microsoft.com	https://access.redhat.com/errata/RHSA-2019:1422
	secure@microsoft.com	https://access.redhat.com/errata/RHSA-2019:2551
	secure@microsoft.com	https://access.redhat.com/errata/RHSA-2019:2552
	secure@microsoft.com	https://github.com/xtermjs/xterm.js/releases
	af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/106434
	af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHBA-2019:0959
	af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2019:1422
	af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2019:2551
	af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2019:2552
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/xtermjs/xterm.js/releases

Impacted products

Vendor	Product	Version
xtermjs	xterm.js	*
redhat	openshift_container_platform	*
redhat	openshift_container_platform	*
redhat	openshift_container_platform	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "xterm.js",
          "vendor": "https://xtermjs.org/",
          "versions": [
            {
              "status": "affected",
              "version": "xterm.js"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xtermjs:xterm.js:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "174C752A-5862-4B2E-81BF-B33C939F6BA2",
              "versionEndExcluding": "5.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F89A265-EBFC-4B1C-8106-B414F815F141",
              "versionEndExcluding": "3.9.99",
              "versionStartIncluding": "3.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "25B054C0-BCF7-4B0A-9059-3DACA95DE9A1",
              "versionEndExcluding": "3.10.163",
              "versionStartIncluding": "3.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D88FD1A-0794-4E79-B51E-91F4403FD1F9",
              "versionEndExcluding": "3.11.104",
              "versionStartExcluding": "3.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en Xterm.js cuando el componente maneja mal los caracteres especiales, tambi\u00e9n conocida como \"Xterm Remote Code Execution Vulnerability\". Esto afecta a xterm.js"
    }
  ],
  "id": "CVE-2019-0542",
  "lastModified": "2026-06-17T02:08:19.950",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-01-09T15:29:00.213",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securityfocus.com/bid/106434"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://access.redhat.com/errata/RHBA-2019:0959"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://access.redhat.com/errata/RHSA-2019:1422"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://access.redhat.com/errata/RHSA-2019:2551"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://access.redhat.com/errata/RHSA-2019:2552"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://github.com/xtermjs/xterm.js/releases"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/106434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHBA-2019:0959"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2019:1422"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2019:2551"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2019:2552"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/xtermjs/xterm.js/releases"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-MC23-976P-J42X

Vulnerability from github – Published: 2019-01-14 16:19 – Updated: 2022-12-18 23:44

Summary

xterm vulnerable to remote code execution

Details

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "xterm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "xterm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.0"
            },
            {
              "fixed": "3.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "xterm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.10.0"
            },
            {
              "fixed": "3.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-0542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:45:48Z",
    "nvd_published_at": "2019-01-09T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters.",
  "id": "GHSA-mc23-976p-j42x",
  "modified": "2022-12-18T23:44:26Z",
  "published": "2019-01-14T16:19:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0542"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xtermjs/xterm.js/commit/3592c641cd0348e0b698e8a180aea2072c6bcd9a"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2019:0959"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:1422"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:2551"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:2552"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mc23-976p-j42x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xtermjs/xterm.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xtermjs/xterm.js/releases/tag/3.8.1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106434"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "xterm vulnerable to remote code execution "
}

GSD-2019-0542

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Aliases

CVE-2019-0542

Aliases

CVE-2019-0542

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-0542",
    "description": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.",
    "id": "GSD-2019-0542",
    "references": [
      "https://access.redhat.com/errata/RHSA-2019:2552",
      "https://access.redhat.com/errata/RHSA-2019:2551",
      "https://access.redhat.com/errata/RHSA-2019:1422",
      "https://access.redhat.com/errata/RHBA-2019:0959"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-0542"
      ],
      "details": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js.",
      "id": "GSD-2019-0542",
      "modified": "2023-12-13T01:23:38.977299Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2019-0542",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "xterm.js",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "xterm.js"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "https://xtermjs.org/"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "106434",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/106434"
          },
          {
            "name": "RHBA-2019:0959",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHBA-2019:0959"
          },
          {
            "name": "RHSA-2019:1422",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:1422"
          },
          {
            "name": "RHSA-2019:2552",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:2552"
          },
          {
            "name": "RHSA-2019:2551",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:2551"
          },
          {
            "name": "https://github.com/xtermjs/xterm.js/releases",
            "refsource": "MISC",
            "url": "https://github.com/xtermjs/xterm.js/releases"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=3.9.1||=3.10.0",
          "affected_versions": "All versions up to 3.9.1, version 3.10.0",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2019-06-10",
          "description": "A remote code execution vulnerability exists in `Xterm.js` when the component mishandles special characters, aka `Xterm Remote Code Execution Vulnerability.` This affects xterm.js.",
          "fixed_versions": [
            "3.9.2",
            "3.10.1"
          ],
          "identifier": "CVE-2019-0542",
          "identifiers": [
            "CVE-2019-0542"
          ],
          "not_impacted": "All versions up to 3.9.1, all versions after 3.9.1 before 3.10.0, all versions after 3.10.0",
          "package_slug": "npm/xterm",
          "pubdate": "2019-01-09",
          "solution": "Upgrade to versions 3.9.2, 3.10.1 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-0542",
            "http://www.securityfocus.com/bid/106434"
          ],
          "uuid": "bf51ee32-5ed6-452a-9bdb-26088a02edb0"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:xtermjs:xterm.js:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.9.99",
                "versionStartIncluding": "3.9",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.10.163",
                "versionStartIncluding": "3.10",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.11.104",
                "versionStartExcluding": "3.11",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-0542"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka \"Xterm Remote Code Execution Vulnerability.\" This affects xterm.js."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-94"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHBA-2019:0959",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHBA-2019:0959"
            },
            {
              "name": "RHSA-2019:2551",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:2551"
            },
            {
              "name": "RHSA-2019:1422",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:1422"
            },
            {
              "name": "106434",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/106434"
            },
            {
              "name": "RHSA-2019:2552",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:2552"
            },
            {
              "name": "https://github.com/xtermjs/xterm.js/releases",
              "refsource": "MISC",
              "tags": [
                "Product",
                "Release Notes"
              ],
              "url": "https://github.com/xtermjs/xterm.js/releases"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-10-27T13:25Z",
      "publishedDate": "2019-01-09T15:29Z"
    }
  }
}

RHBA-2019:0959

Vulnerability from csaf_redhat - Published: 2019-05-01 11:18 - Updated: 2026-06-27 01:04

Summary

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 images update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2019-0542.

CVE-2019-0542

It was found that xterm.js does not sanitize terminal escape sequences in browser terminals allowing for execution of arbitrary commands. An attacker could exploit this by convincing a user with a xterm.js browser terminal to display an escape sequence by, for example, reading a from a log file containing attacker-controlled input.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 153 products

https://access.redhat.com/errata/RHBA-2019:0959

Open the full advisory

RHBA-2019_0959

Vulnerability from csaf_redhat - Published: 2019-05-01 11:18 - Updated: 2024-11-22 13:00

Summary

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 images update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2019-0542.

CVE-2019-0542

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 153 products

https://access.redhat.com/errata/RHBA-2019:0959

Open the full advisory

RHSA-2019:1422

Vulnerability from csaf_redhat - Published: 2019-06-10 16:56 - Updated: 2026-06-27 01:04

Summary

Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift-web-console security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2019-0542.

CVE-2019-0542

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2019:1422

Open the full advisory

RHSA-2019:2551

Vulnerability from csaf_redhat - Published: 2019-09-05 05:05 - Updated: 2026-06-27 01:04

Summary

Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift-web-console security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2019-0542.

CVE-2019-0542

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2019:2551

Open the full advisory

RHSA-2019:2552

Vulnerability from csaf_redhat - Published: 2019-08-22 01:46 - Updated: 2026-06-27 01:04

Summary

Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift-web-console security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2019-0542.

CVE-2019-0542

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2019:2552

Open the full advisory

RHSA-2019_1422

Vulnerability from csaf_redhat - Published: 2019-06-10 16:56 - Updated: 2024-11-22 13:00

Summary

Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift-web-console security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2019-0542.

CVE-2019-0542

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2019:1422

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2019-0542 (GCVE-0-2019-0542)

BDU:2019-02452 (CVE-2019-0542)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour