CVE-2007-6306 Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool....
MediumCVSS 4.3
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jfreechart | = 1.0.8 | No fix listed |
| debian/libjfreechart-java(Debian:12) | < 1.0.9-1 | 1.0.9-1 |
| debian/libjfreechart-java(Debian:13) | < 1.0.9-1 | 1.0.9-1 |
| debian/libjfreechart-java(Debian:14) | < 1.0.9-1 | 1.0.9-1 |
References
- jfreechart.svn.sourceforge.net patch
- jfreechart.svn.sourceforge.net exploit
- jfreechart.svn.sourceforge.net exploit
- 41843 vdb-entry
- 41844 vdb-entry
- 41845 vdb-entry
- RHSA-2008:0630 vendor-advisory
- 27959 third-party-advisory vendor-advisory
- 31493 third-party-advisory
- 3430 third-party-advisory
- www.rapid7.com
- RHSA-2008:0151 vendor-advisory
- RHSA-2008:0158 vendor-advisory
- RHSA-2008:0213 vendor-advisory
- RHSA-2008:0261 vendor-advisory
- 20071206 R7-0031: JFreeChart Image Map Cross-Site Scripting Vulnerabilities mailing-list
- 26752 vdb-entry
- jfreechart-imagemap-xss(38922) vdb-entry
- Debian Security Tracker CVE-2007-6306 vendor-advisory
- bugs.debian.org issue-tracking