Описание
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.lassoAppend' function accepts 3 arguments and internally invokes pushfunction on the 1st argument specifying array consisting of 2nd and 3rd arguments aspushcall argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with apushfunction as the 1st argument,pushfunction can be set to any function that can be access viaevent.view(no all such functions can be exploited due to invalid context or signature, but some can, e.g.console.log). The issue is thatlassoAppenddoesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JSsetImmediatepolyfill basically allowseval`-like functionality). This issue was patched in 5.23.0.
A flaw was found in one of Kibana’s dependencies. This flaw allows an attacker to perform Cross-site scripting (XSS) after loading a maliciously crafted custom visualization in Kibana.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel8-operator | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/kibana6-rhel8 | Not affected | ||
| Red Hat JBoss Fuse 6 | kibana | Out of support scope | ||
| Red Hat JBoss Fuse Service Works 6 | kibana | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.11 | kibana | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-kibana5 | Out of support scope |
Показывать по
Дополнительная информация
Статус:
6.1 Medium
CVSS3
Связанные уязвимости
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.
Vega is a visualization grammar, a declarative format for creating, sa ...
Vega has Cross-site Scripting vulnerability in `lassoAppend` function
6.1 Medium
CVSS3