GitHub Advisory DatabaseGHSA-G662-QQ45-PPWMSmoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
Percentile
49.6%
The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.
Affected configurations
References
github.com/advisories/GHSA-g662-qq45-ppwm
github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98
github.com/joewalnes/smoothie/pull/147
nvd.nist.gov/vuln/detail/CVE-2022-25929
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368
security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
Percentile
49.6%