PT-2018-6053 · Morrisjs · Morris.Js

Published 2018-06-04 · Updated 2019-10-09 · CVE-2017-16022

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: morris.js versions 0.5.0 and earlier

Description: The issue concerns morris.js, which generates svg graphs with hover-over labels. These labels are not properly escaped, allowing for script injection if an attacker gains control over the labels. The injected script runs on the client side when the specific graph is loaded.

Recommendations: For versions 0.5.0 and earlier, install the library from github via: npm i morrisjs/morris.js -s As a temporary workaround, consider restricting access to the graph generation feature until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16022

GHSA-FWX5-5FQJ-JV98

Affected Products

Morris.Js

References · 7

• https://osv.dev/vulnerability/CVE-2017-16022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16022 · Security Note
• https://osv.dev/vulnerability/GHSA-fwx5-5fqj-jv98 · Vendor Advisory
• https://github.com/morrisjs/morris.js/pull/464 · Note
• https://github.com/advisories/GHSA-fwx5-5fqj-jv98 · Note
• https://nodesecurity.io/advisories/307 · Note
• https://npmjs.com/advisories/307 · Note