medium6.3
CVE-2020-7747
Cross-site Scripting in lightning-server
Impact
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | lightning-server | <= 1.3.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightning-Viz | Lightning | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
- https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381
- https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
- https://github.com/advisories/GHSA-gmch-cm2p-9qw9
- https://nvd.nist.gov/vuln/detail/CVE-2020-7747