Denial of Service Vulnerability in Highcharts JS by Highsoft
CVE-2018-20801

7.5HIGH

Key Information:

Vendor

Highcharts

Status
Highcharts
Vendor
CVE Published:
14 March 2019

What is CVE-2018-20801?

A vulnerability in the SVGRenderer component of Highcharts JS prior to version 6.1.0 allows an attacker to exploit backtracking regular expressions. This can lead to a denial of service condition, affecting the availability and functionality of applications utilizing this library. Attackers can leverage this loophole to craft inputs that cause excessive backtracking, ultimately resulting in service disruption.

References

https://snyk.io/vuln/npm:highcharts:20180225
x_refsource_MISC
https://github.com/highcharts/highcharts/commit/7c547e1e0...
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20190715-0001/
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.