High, CVSS 7.2npmAmendedPublished
Stored XSS in TimelineJS3
CVE-2020-15092 · GHSA-2jpm-827p-j44g
- Affected
- npm @knight-lab/timelinejs < 3.7.0
- Fixed in
- 3.7.0· Vendor fix available
- Issue
- Impact TimelineJS renders some user data as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if write access to the system hosting that document is otherwise compromised. Although the vulnerability has a CVSS v3.1 base score of 7.2, this vulnerability has a severity of…
Recommended action: Upgrade to 3.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.