← back
CVE-2020-7747

Cross-site Scripting (XSS)

CVSS 6.3 MEDIUMEPSS 0.9%
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C
Affected products
n/a · lightning-server

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381