HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2021-29489

CVSS 7.6v3.1pub. 2021-05-05upd. 2024-11-21

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

  • Highcharts

    APP
    Highcharts
    < 9.0.0

  • Netapp Cloud Backup

    APP
    Netapp
    all versions

  • Netapp Oncommand Insight

    APP
    Netapp
    all versions

  • Netapp Oncommand Workflow Automation

    APP
    Netapp
    all versions

  • Netapp Snapcenter

    APP
    Netapp
    all versions
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2021-44228CRITICAL10.0⚠ KEVPL ✓same product

Apache Log4j2 Log4Shell — RCE przez podatną funkcję JNDI lookup

CVE-2021-42013CRITICAL9.8⚠ KEVPL ✓same product

Apache HTTP Server 2.4.50 — path traversal i RCE (niewystarczający patch CVE-2021-41773)

CVE-2021-41773CRITICAL9.8⚠ KEVPL ✓same product

Apache HTTP Server 2.4.49 — path traversal i RCE (aktywnie exploitowany)

CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same product

SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego

CVE-2016-8735CRITICAL9.8⚠ KEVPL ✓same product

Apache Tomcat RCE przez JmxRemoteLifecycleListener (JMX)