CVE-2016-10537 Cross-Site Scripting in backbone
MediumCVSS 5.4
EPSS 0.66%
- Published
- Updated
- Exploit status
- No public exploit known
Description
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the Model#Escape function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as < to <.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/backbone(Debian:12) | < 0.5.3-1 | 0.5.3-1 |
| debian/backbone(Debian:13) | < 0.5.3-1 | 0.5.3-1 |
| debian/backbone(Debian:14) | < 0.5.3-1 | 0.5.3-1 |
| backbone project backbone | <= 0.3.3 | No fix listed |
| npm backbone(npm) | >= 0.3.3, < 0.5.0 | 0.5.0 |
| HackerOne backbone node module | = <= 0.3.3 | No fix listed |
References
- Debian Security Tracker CVE-2016-10537 vendor-advisory
- github.com issue-tracking third-party-advisory
- nodesecurity.io third-party-advisory
- nvd.nist.gov third-party-advisory
- github.com patch
- backbonejs.org
- github.com patch
- github.com
- github.com