QID 995652

Date Published: 2023-10-25

QID 995652: NodeJs (Npm) Security Update for mxgraph (GHSA-xm59-jvxm-cp3v)

mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the creation and editing of draw.io-based diagrams in Confluence. Among other things, it allows to set the background color of text displayed in the diagram. The color provided by the user is notproperly sanitized, leading to HTML and JavaScript code to be displayed "as it is" to visitors of the page. This allows attackers to execute JavaScript code in the context of the visitor's browser and session and to e.g. run Confluence command under the visitor's user or attack the visitor's browser.

Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.

  • CVSS V3 rated as High - 6.1 severity.
  • CVSS V2 rated as Medium - 4.3 severity.
    • Solution
    Refer to Github security advisory GHSA-xm59-jvxm-cp3v for updates and patch information.
    Vendor References

    CVEs related to QID 995652

    CVE-2019-13127 |
    Software Advisories
    Advisory ID Software Component Link
    GHSA-xm59-jvxm-cp3v mxgraph URL Logo github.com/advisories/GHSA-xm59-jvxm-cp3v
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].