Cross-site Scripting (XSS)

2020-10-2106:21:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

vulnerability

lightning-server

adddata function

session controller

malicious script

user's browser

error message

injection

execute

software

EPSS

0.001

Percentile

41.5%

JSON

lightning-server is vulnerable to cross-site scripting (XSS). An attacker is able to inject and execute malicious script in a user’s browser via an error message in the session controller’s addData function.

References

github.com/lightning-viz/lightning/blob/master/app/controllers/session.js

github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230

github.com/lightning-viz/lightning/blob/v1.3.0/app/controllers/session.js#L230

EPSS

0.001

Percentile

41.5%

JSON

Related for VERACODE:27637