CVE-2017-16022 Cross-Site Scripting in morris.js
MediumCVSS 6.1
EPSS 0.87%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm morris.js(npm) | = 0.5.0 | No fix listed |
| morris.js project morris.js | <= 0.5.0 | No fix listed |
| HackerOne Morris.js node module | = <=0.5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory