PT-2022-13013 · Three.Js · Three.Js

Published 2022-01-24 · Updated 2022-01-28 · CVE-2022-0177

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions three.js versions prior to 0.137.0

Description The issue allows attackers to inject arbitrary javascript into a user's browser due to the loading of untrusted iframes. This is a Cross-site Scripting (XSS) - DOM issue.

Recommendations For versions prior to 0.137.0, update to version 0.137.0 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0177

GHSA-7VVQ-7R29-5VG3

Affected Products

Three.Js

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-0177 · Security Note
• https://osv.dev/vulnerability/GHSA-7vvq-7r29-5vg3 · Vendor Advisory
• https://github.com/mrdoob/three.js/pull/23245 · Note
• https://github.com/mrdoob/three.js · Note
• https://github.com/mrdoob/three.js/commit/0c31bc605e21965aad8a6479bb1969351773f76d · Note
• https://t.me/cvenotify/25792 · Telegram Post
• https://huntr.dev/bounties/16901080-99b4-4fb5-8c5b-931bfbf33cba · Note
• https://t.me/cibsecurity/36172 · Telegram Post