MEDIUM5.4

GHSA-9cgf-pxwq-2cpw

Stimulsoft Dashboard.JS Cross Site Scripting vulnerability

Quick fix

GHSA-9cgf-pxwq-2cpw — stimulsoft-dashboards-js: upgrade to the fixed version with the command below.

npm install stimulsoft-dashboards-js@2024.1.2

Details

Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/stimulsoft-dashboards-js

Introduced in: 0Fixed in: 2024.1.2

Fixnpm install stimulsoft-dashboards-js@2024.1.2

References

https://nvd.nist.gov/vuln/detail/CVE-2024-24397[ADVISORY]
https://cloud-trustit.spp.at/s/Pi78FFazHamJQ5R[WEB]
https://cves.at/posts/cve-2024-24397/writeup[WEB]
https://github.com/stimulsoft/Dashboards.JS[PACKAGE]
http://stimulsoft.com[WEB]