WS-2016-0048 (Medium) detected in c3-0.4.10.min.js
mend-bolt-for-github opened this issue · comments
WS-2016-0048 - Medium Severity Vulnerability
Vulnerable Library - c3-0.4.10.min.js
D3-based reusable chart library
Library home page: https://cdnjs.cloudflare.com/ajax/libs/c3/0.4.10/c3.min.js
Path to dependency file: /datas.html
Path to vulnerable library: /datas.html
Dependency Hierarchy:
❌ c3-0.4.10.min.js (Vulnerable Library)
Found in HEAD commit: 945390914344bdf319a2f66dfe12c41fb73eeae9
Found in base branch: master
Vulnerability Details
C3 is a D3-based reusable chart library that enables deeper integration of charts into web applications.
Versions 0.4.10 and lower of c3 contain a cross site scripting (XSS) vulnerability through improper html sanitization on rendered tooltips.
Publish Date: 2016-05-01
URL: WS-2016-0048
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2016-0048
Release Date: 2016-05-01
Fix Resolution: c3 - 0.4.11-rc2
Step up your Open Source Security Game with Mend here
add readme