PT-2018-4716 · Bakbone · Backbone

Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10537

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions backbone versions 0.3.3 and earlier

Description The issue arises from a potential Cross Site Scripting vulnerability in the Model#Escape function. This vulnerability occurs when a user is able to supply input, and the output is then written to the DOM. The regular expression used to encode metacharacters fails to account for HTML Entities, such as <, which represents the less-than sign (<). This failure can lead to the execution of malicious scripts.

Recommendations Update to version 0.5.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10537

GHSA-J6P2-CX3W-6JCP

Affected Products

Backbone

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2016-10537 · Security Note
• https://osv.dev/vulnerability/GHSA-j6p2-cx3w-6jcp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10537 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10537 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10537 · Vendor Advisory
• https://github.com/jashkenas/backbone/blame/0cdc525961d3fa98e810ffae6bcc8e3838e36d93/backbone.js · Note
• https://github.com/jashkenas/backbone/commit/7ae0384120c2552e1c426cda7fb02fdce6ef1076 · Note
• https://github.com/jashkenas/backbone · Note
• https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008 · Note
• https://github.com/jashkenas/backbone/commit/0cdc525961d3fa98e810ffae6bcc8e3838e36d93 · Note
• https://nodesecurity.io/advisories/108 · Note
• https://github.com/advisories/GHSA-j6p2-cx3w-6jcp · Note
• https://npmjs.com/advisories/108 · Note
• https://backbonejs.org/#changelog · Note