PT-2007-7175 · Jfreechart · Jfreechart

Published 2007-12-11 · Updated 2018-10-15 · CVE-2007-6306

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JFreeChart version 1.0.8

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the image map feature. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific attributes, including the chart name, chart tool tip text, or attributes of a chart area such as href, shape, or coords.

Recommendations For JFreeChart version 1.0.8, consider disabling the image map feature until a patch is available to prevent exploitation of the XSS vulnerabilities. Restrict input for chart names, tool tip texts, and chart area attributes to minimize the risk of arbitrary script injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-6306

RHSA-2008:0151

RHSA-2008:0158

RHSA-2008:0213

RHSA-2008:0261

RHSA-2008:0524

RHSA-2008:0630

Affected Products

Jfreechart

References · 22

• 🔥 http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662&r2=661&pathrev=662 · Exploit
• 🔥 http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662&r2=661&pathrev=662 · Exploit
• http://redhat.com/support/errata/RHSA-2008-0151.html · Vendor Advisory
• http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679&r2=680 · Patch
• http://rhn.redhat.com/errata/RHSA-2008-0630.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6306 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6306 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0158.html · Vendor Advisory
• http://secunia.com/advisories/27959 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0213.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-6306 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://securityreason.com/securityalert/3430 · Note
• http://securityfocus.com/bid/26752 · Note