Cross-site Scripting in cesium

Description

A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim’s browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.111.0

References

• GHSA-4532-pmx7-9ww7
• CVE-2023-48094
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-Site-Scripting attack on `<RichTextField>` - react-admin - CVE-2023-25572
• Vega Expression Language `scale` expression function Cross Site Scripting - vega - CVE-2023-26486
• Vega Expression Language `scale` expression function Cross Site Scripting - CVE-2023-26486
• Vega has Cross-site Scripting vulnerability in `lassoAppend` function - vega - CVE-2023-26487

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

cesium