PT-2018-6053 · Morrisjs · Morris.Js

Publicado 2018-06-04 · Atualizado 2019-10-09 · CVE-2017-16022

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: morris.js versions 0.5.0 and earlier

Description: The issue concerns morris.js, which generates svg graphs with hover-over labels. These labels are not properly escaped, allowing for script injection if an attacker gains control over the labels. The injected script runs on the client side when the specific graph is loaded.

Recommendations: For versions 0.5.0 and earlier, install the library from github via: npm i morrisjs/morris.js -s As a temporary workaround, consider restricting access to the graph generation feature until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16022

GHSA-FWX5-5FQJ-JV98

Produtos afetados

Morris.Js

Referências · 7

• https://github.com/morrisjs/morris.js/pull/464 · Nota
• https://osv.dev/vulnerability/CVE-2017-16022 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16022 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fwx5-5fqj-jv98 · Aviso do Fabricante
• https://github.com/advisories/GHSA-fwx5-5fqj-jv98 · Nota
• https://nodesecurity.io/advisories/307 · Nota
• https://npmjs.com/advisories/307 · Nota