CVE-2020-28487

Опубликовано: 22 янв. 2021

Источник: nvd

CVSS3: 6.8

CVSS2: 6

EPSS Низкий

Описание

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

Ссылки

https://github.com/visjs/vis-timeline/issues/838
Issue Tracking
Third Party Advisory
https://github.com/visjs/vis-timeline/pull/840
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500
Exploit
Patch
Third Party Advisory
https://github.com/visjs/vis-timeline/issues/838
Issue Tracking
Third Party Advisory
https://github.com/visjs/vis-timeline/pull/840
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:visjs:vis-timeline:*:*:*:*:*:node.js:*:*

Версия до 7.4.4 (исключая)

EPSS

Процентиль: 66%

0.00517

Низкий

6.8 Medium

CVSS3

6 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-9mrv-456v-pf22