PT-2019-14819 · Pannellum · Pannellum

Max Schaefer · Publicado 2019-11-22 · Atualizado 2019-12-04 · CVE-2019-16763

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pannellum versions 2.5.0 through 2.5.5

Description The issue allows for potential Cross-Site Scripting (XSS) attacks due to insufficient sanitization of URLs for data URIs. An attack would require a user to click on a hot spot and would need an attacker-provided configuration. A plausible attack scenario involves hosting pannellum.htm on a domain that shares cookies with the targeted site's user authentication, allowing an attacker to embed an iframe on their site and potentially access information from the targeted site as the authenticated user if the user clicks on a hot spot in the attacker's embedded panorama viewer.

Recommendations For versions 2.5.0 through 2.5.5, upgrade to version 2.5.6 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16763

GHSA-M52X-29PQ-W3VV

Produtos afetados

Pannellum

Referências · 8

• https://github.com/mpetroff/pannellum · Nota
• https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914 · Correção
• https://github.com/mpetroff/pannellum/security/advisories/GHSA-m52x-29pq-w3vv · Nota
• https://npmjs.com/advisories/1418 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16763 · Nota de Segurança
• https://github.com/advisories/GHSA-m52x-29pq-w3vv · Nota
• https://osv.dev/vulnerability/GHSA-m52x-29pq-w3vv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-16763 · Aviso do Fabricante