← Volver a CVEs

CVE-2021-29489

HIGH

7.6

Descripcion

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

Detalles CVE

Puntuacion CVSS v3.17.6

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado5/5/2021

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

highcharts:highchartsnetapp:cloud_backupnetapp:oncommand_insightnetapp:oncommand_workflow_automationnetapp:snapcenter

Debilidades (CWE)

CWE-79

Referencias

https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95(security-advisories@github.com)

https://security.netapp.com/advisory/ntap-20210622-0005/(security-advisories@github.com)

https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20210622-0005/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.