Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-43788

19
FAUCET Score

CVE-2024-43788 describes a DOM Clobbering vulnerability in Webpack's AutoPublicPathRuntimeModule, affecting webpack.js. This flaw allows for Cross-Site Scripting (XSS) in web pages that utilize Webpack-generated files and permit user-controlled, scriptless HTML elements with unsanitized name or id attributes. Rated as MEDIUM severity (CVSS 6.1), it requires user interaction and can lead to partial loss of confidentiality and integrity. While real-world exploitation has been observed in Canvas LMS, there is currently no public exploit code, Metasploit module, or significant community discussion, and it is not listed on the KEV catalog.

Impacted Technologies

VendorProductVersion(s)CPE
< 5.94.0CPE matchmatch criteria
cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

6.4MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
Exploitability Score
1.6
Impact Score
4.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.90%
Probability of exploitation in next 30 days
EPSS Percentile
56.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0090 is in the 67th percentile among its peer group of 26,221 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (103)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 19693-17084Fixed in: 2.16.2-3
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 2.16.2-3
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 2.16.2-3
microsoftpatch availablevia msrc
Product: azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0Fixed in: 2.16.2-3
microsoftpatch availablevia msrc
Product: azl3 python-tensorboard 2.16.2-3 on Azure Linux 3.0Fixed in: 2.16.2-3
microsoftpatch availablevia msrc
Product: 17645-17084Fixed in: 2.16.2-3
npmpatch availablevia ghsa
Product: webpackFixed in: 5.94.0
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-storage-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/jfr-datasource-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Discovery 1 for RHEL 9Fixed in: discovery/discovery-server-rhel9:1.12.0-1
View patch
redhatpatch availablevia redhat_api
Product: Discovery 1 for RHEL 9Fixed in: discovery/discovery-ui-rhel9:1.12.0-1
View patch
redhatpatch availablevia redhat_api
Product: NETWORK-OBSERVABILITY-1.7.0-RHEL-9Fixed in: network-observability/network-observability-cli-rhel9:v1.7.0-67
View patch
redhatpatch availablevia redhat_api
Product: NETWORK-OBSERVABILITY-1.7.0-RHEL-9Fixed in: network-observability/network-observability-console-plugin-rhel9:v1.7.0-67
View patch
redhatpatch availablevia redhat_api
Product: NETWORK-OBSERVABILITY-1.7.0-RHEL-9Fixed in: network-observability/network-observability-ebpf-agent-rhel9:v1.7.0-67
View patch
redhatpatch availablevia redhat_api
Product: NETWORK-OBSERVABILITY-1.7.0-RHEL-9Fixed in: network-observability/network-observability-flowlogs-pipeline-rhel9:v1.7.0-67
View patch
redhatpatch availablevia redhat_api
Product: NETWORK-OBSERVABILITY-1.7.0-RHEL-9Fixed in: network-observability/network-observability-operator-bundle:1.7.0-86
View patch
redhatpatch availablevia redhat_api
Product: NETWORK-OBSERVABILITY-1.7.0-RHEL-9Fixed in: network-observability/network-observability-rhel9-operator:v1.7.0-67
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Data GridFixed in: webpack
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.8Fixed in: rhmtc/openshift-migration-ui-rhel8:v1.8.5-7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/grafana-rhel8:2.4.11-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/istio-must-gather-rhel8:2.4.11-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/kiali-rhel8:1.65.16-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/pilot-rhel8:2.4.11-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/proxyv2-rhel8:2.4.11-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/ratelimit-rhel8:2.4.11-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/grafana-rhel8:2.5.5-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/istio-cni-rhel8:2.5.5-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/istio-must-gather-rhel8:2.5.5-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/kiali-ossmc-rhel8:1.73.14-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/kiali-rhel8:1.73.15-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/pilot-rhel8:2.5.5-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/proxyv2-rhel8:2.5.5-6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.5 for RHEL 8Fixed in: openshift-service-mesh/ratelimit-rhel8:2.5.5-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/grafana-rhel8:2.6.2-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/istio-cni-rhel8:2.6.2-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/istio-must-gather-rhel8:2.6.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/istio-rhel8-operator:2.6.2-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/kiali-ossmc-rhel8:1.89.2-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/kiali-rhel8:1.89.4-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/kiali-rhel8-operator:1.89.6-1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/pilot-rhel8:2.6.2-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 8Fixed in: openshift-service-mesh/ratelimit-rhel8:2.6.2-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.6 for RHEL 9Fixed in: openshift-service-mesh/proxyv2-rhel9:2.6.2-7
View patch
redhatpatch availablevia redhat_api
Product: RHODF-4.14-RHEL-9Fixed in: odf4/odf-console-rhel9:v4.14.13-3
View patch
redhatpatch availablevia redhat_api
Product: RHODF-4.16-RHEL-9Fixed in: odf4/odf-console-rhel9:v4.16.3-1
View patch
redhatpatch availablevia redhat_api
Product: RHODF-4.17-RHEL-9Fixed in: odf4/odf-console-rhel9:v4.17.0-53
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.34.0-6
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-data-index-postgresql-rhel8:1.34.0-6
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.34.0-5
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.34.0-6
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.34.0-2
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-management-console-rhel8:1.34.0-5
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-operator-bundle:1.34.0-5
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-rhel8-operator:1.34.0-5
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-swf-builder-rhel8:1.34.0-6
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.34-RHEL-8Fixed in: openshift-serverless-1/logic-swf-devmode-rhel8:1.34.0-6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Service Mesh 2.4 for RHEL 8Fixed in: openshift-service-mesh/istio-cni-rhel8:2.4.11-2
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-db-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-grafana-dashboard-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-operator-bundle:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-ose-oauth-proxy-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-reports-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-rhel8:3.0.1-3
View patch
redhatpatch availablevia redhat_api
Product: Cryostat 3 on RHEL 8Fixed in: cryostat-tech-preview/cryostat-rhel8-operator:3.0.1-3
View patch
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/logging-view-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: Migration Toolkit for RuntimesFixed in: webpack
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Data Science (RHODS)Fixed in: rhods/odh-dashboard-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-networking-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/nmstate-console-plugin-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: nodejs-webpack
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/code-rhel8
redhatno patchvia redhat_api
Product: Node HealthCheck OperatorFixed in: workload-availability/node-remediation-console-rhel8
redhatno patchvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed-beta/lightspeed-console-plugin-rhel9
redhatno patchvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-console-plugin-rhel8
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-controller
redhatno patchvia redhat_api
Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: webpack
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 3.11Fixed in: openshift3/ose-console
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-monitoring-plugin-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argocd-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/console-plugin-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift Virtualization 4Fixed in: container-native-virtualization/kubevirt-console-plugin-rhel9
redhatno patchvia redhat_api
Product: Red Hat Trusted Profile AnalyzerFixed in: rhtpa/rhtpa-trustification-service-rhel9
redhatno patchvia redhat_api
Product: Migration Toolkit for VirtualizationFixed in: migration-toolkit-virtualization/mtv-console-plugin-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Advanced Cluster Security 4Fixed in: advanced-cluster-security/rhacs-main-rhel8
redhatend of lifevia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-ui-rhel8
redhatend of lifevia redhat_api
Product: Red Hat Certification for Red Hat Enterprise Linux 7Fixed in: redhat-certification
redhatend of lifevia redhat_api
Product: Red Hat build of OptaPlanner 8Fixed in: webpack
redhatend of lifevia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: aap-cloud-ui-container
redhatend of lifevia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/jaeger-agent-rhel8
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: js-d3-flame-graph
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argo-rollouts-rhel8
redhatend of lifevia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: 3scale-amp-system-container
redhatend of lifevia redhat_api
Product: Migration Toolkit for Applications 7Fixed in: mta/mta-ui-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: firefox
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: thunderbird
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: thunderbird
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: js-d3-flame-graph
redhatend of lifevia redhat_api
Product: Red Hat Fuse 7Fixed in: webpack
redhatend of lifevia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: odh-dashboard-container
redhatend of lifevia redhat_api
Product: Red Hat Process Automation 7Fixed in: webpack
redhatend of lifevia redhat_api
Product: Red Hat Developer HubFixed in: rhdh/rhdh-hub-rhel9

Vendor Advisories (4)

microsoft2024-Oct/CVE-2024-43788

CVE-2024-43788

Oct 8, 2024
npmGHSA-4vvj-4cpr-p986medium

Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

Aug 27, 2024
redhatCVE-2024-43788Moderate

webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule

Aug 27, 2024
microsoft2024-Aug/CVE-2024-43788Moderate

DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

Aug 13, 2024

References

github.com / webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
Patch
github.com / webpack/webpack/issues/18718
github.com / webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
ExploitVendor Advisory
research.securitum.com / xss-in-amp4email-dom-clobbering
ExploitThird Party Advisory
scnps.co / papers/sp23_domclob.pdf
ExploitMitigationTechnical DescriptionThird Party Advisory