6.1med
CVE-2017-16022
Cross-Site Scripting in morris.js
Also known as GHSA-fwx5-5fqj-jv98
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
0
none known
Summary
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
Exploit prediction (EPSS)
0.89% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | morris.js | 1 listed versions | no fix listed |
Affected products
- HackerOne Morris.js node module
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- nodesecurity.io /advisories/307 · x_refsource_MISC, x_transferred
- github.com /morrisjs/morris.js/pull/464 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-16022 · advisory
- github.com /advisories/GHSA-fwx5-5fqj-jv98 · advisory
- npmjs.com /advisories/307 · web
Sources
- CVE List: CVE-2017-16022
- GitHub Advisory: GHSA-fwx5-5fqj-jv98
- NVD: CVE-2017-16022
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.