PT-2019-14819 · Pannellum · Pannellum

Max Schaefer · Published 2019-11-22 · Updated 2019-12-04 · CVE-2019-16763

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pannellum versions 2.5.0 through 2.5.5

Description The issue allows for potential Cross-Site Scripting (XSS) attacks due to insufficient sanitization of URLs for data URIs. An attack would require a user to click on a hot spot and would need an attacker-provided configuration. A plausible attack scenario involves hosting pannellum.htm on a domain that shares cookies with the targeted site's user authentication, allowing an attacker to embed an iframe on their site and potentially access information from the targeted site as the authenticated user if the user clicks on a hot spot in the attacker's embedded panorama viewer.

Recommendations For versions 2.5.0 through 2.5.5, upgrade to version 2.5.6 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16763

GHSA-M52X-29PQ-W3VV

Affected Products

Pannellum

References · 8

• https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-16763 · Security Note
• https://osv.dev/vulnerability/GHSA-m52x-29pq-w3vv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16763 · Vendor Advisory
• https://github.com/mpetroff/pannellum · Note
• https://github.com/mpetroff/pannellum/security/advisories/GHSA-m52x-29pq-w3vv · Note
• https://npmjs.com/advisories/1418 · Note
• https://github.com/advisories/GHSA-m52x-29pq-w3vv · Note