Cross site scripting in three.js

High severity GitHub Reviewed Published Jan 27, 2022 to the GitHub Advisory Database • Updated Feb 3, 2023

Withdrawn This advisory was withdrawn on Jan 28, 2022

Package

three (npm)

Affected versions

< 0.137.0

Patched versions

0.137.0

Description

CVE has been withdrawn

Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.

References

Published by the National Vulnerability Database

Jan 24, 2022

Reviewed Jan 25, 2022

Published to the GitHub Advisory Database Jan 27, 2022

Withdrawn Jan 28, 2022

Last updated Feb 3, 2023

Severity

High

7.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N