CVE-2020-7747 Information

Description

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Reference

https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js23L230 https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

LOW

Base Score

NONE

Base Severity

6.3