CVE-2024-43788 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-43788 Interim 1 13 2026-03-05T02:13:29Z current 2024-08-28T23:10:12Z 2026-03-05T02:13:29Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-43788 Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack's `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2024-October/019689.html E-Mail link for SUSE-SU-2024:3771-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES-LTSS-TERADATA 15 SP2 SUSE Linux Enterprise Module for Python 3 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Python 3 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Python 3 15 SP6 SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Python 3 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Manager Proxy 4.3 SUSE Manager Proxy LTS 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Retail Branch Server LTS 4.3 SUSE Manager Server 4.3 SUSE Manager Server LTS 4.3 openSUSE Leap 15.5 openSUSE Leap 15.6 openSUSE Tumbleweed forgejo-8.0.3-1.1 forgejo-apparmor-8.0.3-1.1 forgejo-firewalld-8.0.3-1.1 forgejo-selinux-8.0.3-1.1 pgadmin4 pgadmin4-8.5-150600.3.6.1 pgadmin4-cloud-8.5-150600.3.6.1 pgadmin4-desktop-8.5-150600.3.6.1 pgadmin4-doc pgadmin4-doc-8.5-150600.3.6.1 pgadmin4-web pgadmin4-web-uwsgi pgadmin4-web-uwsgi-8.5-150600.3.6.1 rollup-3.29.5-1.1 system-user-pgadmin system-user-pgadmin-8.5-150600.3.6.1 pgadmin4-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 pgadmin4-doc-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 system-user-pgadmin-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 pgadmin4-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4-doc-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 system-user-pgadmin-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-cloud-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-desktop-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-doc-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-web-uwsgi-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 system-user-pgadmin-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 forgejo-8.0.3-1.1 as a component of openSUSE Tumbleweed forgejo-apparmor-8.0.3-1.1 as a component of openSUSE Tumbleweed forgejo-firewalld-8.0.3-1.1 as a component of openSUSE Tumbleweed forgejo-selinux-8.0.3-1.1 as a component of openSUSE Tumbleweed rollup-3.29.5-1.1 as a component of openSUSE Tumbleweed pgadmin4 as a component of SLES-LTSS-TERADATA 15 SP2 pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4 as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4-doc as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4-web as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 system-user-pgadmin as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 pgadmin4-doc as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 pgadmin4-web as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP6-LTSS system-user-pgadmin as a component of SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server Teradata 15 SP4 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 system-user-pgadmin as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4 as a component of SUSE Manager Proxy 4.3 pgadmin4-doc as a component of SUSE Manager Proxy 4.3 pgadmin4-web as a component of SUSE Manager Proxy 4.3 pgadmin4 as a component of SUSE Manager Proxy LTS 4.3 pgadmin4-doc as a component of SUSE Manager Proxy LTS 4.3 pgadmin4-web as a component of SUSE Manager Proxy LTS 4.3 pgadmin4 as a component of SUSE Manager Retail Branch Server 4.3 pgadmin4-doc as a component of SUSE Manager Retail Branch Server 4.3 pgadmin4-web as a component of SUSE Manager Retail Branch Server 4.3 pgadmin4 as a component of SUSE Manager Retail Branch Server LTS 4.3 pgadmin4-doc as a component of SUSE Manager Retail Branch Server LTS 4.3 pgadmin4-web as a component of SUSE Manager Retail Branch Server LTS 4.3 pgadmin4 as a component of SUSE Manager Server 4.3 pgadmin4-doc as a component of SUSE Manager Server 4.3 pgadmin4-web as a component of SUSE Manager Server 4.3 pgadmin4 as a component of SUSE Manager Server LTS 4.3 pgadmin4-doc as a component of SUSE Manager Server LTS 4.3 pgadmin4-web as a component of SUSE Manager Server LTS 4.3 pgadmin4 as a component of openSUSE Leap 15.5 pgadmin4-doc as a component of openSUSE Leap 15.5 pgadmin4-web as a component of openSUSE Leap 15.5 pgadmin4-web-uwsgi as a component of openSUSE Leap 15.5 Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack's `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue. CVE-2024-43788 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:pgadmin4-cloud-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:pgadmin4-desktop-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:pgadmin4-web-uwsgi-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP7:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP7:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP7:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Tumbleweed:forgejo-8.0.3-1.1 openSUSE Tumbleweed:forgejo-apparmor-8.0.3-1.1 openSUSE Tumbleweed:forgejo-firewalld-8.0.3-1.1 openSUSE Tumbleweed:forgejo-selinux-8.0.3-1.1 openSUSE Tumbleweed:rollup-3.29.5-1.1 moderate 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L