PT-2020-7944 · C3 · C3

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000240

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: c3 versions prior to 0.4.11

Description: The issue is related to cross-site scripting via improper sanitization of HTML in rendered tooltips.

Recommendations: Update to 0.4.11 or later.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-1000240

GHSA-GVG7-PP82-CFF3

Affected Products

C3

References · 7

• https://osv.dev/vulnerability/GHSA-gvg7-pp82-cff3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000240 · Security Note
• https://github.com/c3js/c3/commit/de3864650300488a63d0541620e9828b00e94b42 · Note
• https://github.com/c3js/c3/pull/1675 · Note
• https://github.com/c3js/c3 · Note
• https://github.com/c3js/c3/issues/1536 · Note
• https://npmjs.com/advisories/138 · Note