CVE-2021-29489

Description

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end users browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.197

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in Netapp Oncommand Insight 2.3	Windows
Multiple Vulnerabilities are affected in Netapp Snapcenter 2.3	Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Workflow Automation 2.3	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234