PT-2020-21318 · Highsoft · Highcharts

Published 2020-08-25 · Updated 2020-08-25

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions highcharts versions prior to 7.2.2 highcharts versions prior to 8.1.1

Description The issue arises from the failure to sanitize href values and the lack of restriction on URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.

Recommendations For versions prior to 7.2.2, update to version 7.2.2 or later. For versions prior to 8.1.1, update to version 8.1.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-GR4J-R575-G665

Affected Products

Highcharts

References · 5

• https://osv.dev/vulnerability/GHSA-gr4j-r575-g665 · Vendor Advisory
• https://github.com/highcharts/highcharts/issues/13559 · Note
• https://github.com/highcharts/highcharts/commit/55c39dd55f12ce8dfab84f8ec13ad81423bee9f5 · Note
• https://github.com/highcharts/highcharts · Note
• https://snyk.io/vuln/SNYK-JS-HIGHCHARTS-571995 · Note