PT-2022-17607
CVE-2022-25929
·
Published
2022-12-21
·
Updated
2022-12-27
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
smoothie versions 1.31.0 through 1.36.1
Description
The issue arises from improper user input sanitization in
strokeStyle and tooltipLabel properties, leading to Cross-site Scripting (XSS). This can be exploited when a user has control over these properties.Recommendations
For smoothie versions 1.31.0 through 1.36.1, consider disabling the use of
strokeStyle and tooltipLabel properties until a patch is available to prevent potential XSS attacks. Restrict access to these properties to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾