Lucene search

Veracode Vulnerability DatabaseVERACODE:48215

HistoryJul 24, 2024 - 8:11 a.m.

Denial Of Service (DoS)

2024-07-2408:11:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

infinite loop

drawcanvas()

stackedbarchart

untrusted input

attacker

github.com/wcharczuk/go-chart

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

github.com/wcharczuk/go-chart is vulnerable to Denial of Service (DoS). The vulnerability is due to an infinite loop when executing the drawCanvas() function with a StackedBarChart containing a long name value. If the name value originates from untrusted input, an attacker can cause an infinite loop.

References

gist.github.com/F3iG0n9/4d0d7c863eea6874eeeb26a3073aa5f8

github.com/advisories/GHSA-jq6p-6wg4-wrw8

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

Related for VERACODE:48215