The Red Hat build of Cryostat 3 on RHEL 8 is affected by two security vulnerabilities. The first is a DOM Clobbering vulnerability in webpack's AutoPublicPathRuntimeModule identified as CVE-2024-43788. The second is a cross-site scripting (XSS) vulnerability caused by prototype pollution in dompurify, tracked as CVE-2024-45801. Red Hat has released an update to address these vulnerabilities. The advisory rates the security impact as moderate and recommends applying the update after ensuring all previous errata are applied. No CVSS base scores are provided in the advisory, but detailed information is available on the respective CVE pages.

Successful exploitation of these vulnerabilities could allow an attacker to manipulate the Document Object Model (DOM) leading to potential security issues such as cross-site scripting (XSS). This could result in the execution of malicious scripts in the context of the affected application. The vulnerabilities are rated as moderate impact by Red Hat, indicating a significant but not critical risk to affected systems.

Red Hat has released an official security update for Cryostat 3 on RHEL 8 that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released relevant errata have been applied. Detailed instructions for applying the update are available at Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the provided update.