Description

The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.

Remediation

References

https://snyk.io/vuln/SNYK-JS-APEXCHARTS-1062708

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1070616

https://github.com/apexcharts/apexcharts.js/pull/2158

https://github.com/apexcharts/apexcharts.js/commit/68f3f34d125719b4767614fe0a595cc65bde1d19

Related Vulnerabilities

CVE-2020-7617 Vulnerability in npm package ini-parser

CVE-2017-7675 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2022-34305 Vulnerability in maven package org.apache.tomcat:tomcat

CVE-2022-38750 Vulnerability in maven package org.yaml:snakeyaml

CVE-2017-16187 Vulnerability in npm package open-device

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Tags

Third Party Advisory Exploit Patch