Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Invalid integrity hashes in webpack-subresource-integrity
Vulnerability Description
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Type
对数据真实性的验证不充分
Vulnerability Title
webpack-subresource-integrity 数据伪造问题漏洞
Vulnerability Description
webpack-subresource-integrity是个人开发者的一个应用于网站静态文件安全的 npm 扩展库。该库可产生加密的 Hash 编码用于验证浏览器获取的文件（例如从CDN获取）是安全的。 webpack-subresource-integrity 1.5.1之前版本存在安全漏洞，该漏洞源于所有动态加载的区块都会收到一个无效的完整性哈希，浏览器会忽略这个哈希，因此浏览器无法验证它们的完整性。
CVSS Information
N/A
Vulnerability Type
N/A