CVE-2007-6306
published 2007-12-11CVE-2007-6306: Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML…
PriorityP417medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.76%
84.4th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libjfreechart-java | < libjfreechart-java 1.0.9-1 (bookworm) | libjfreechart-java 1.0.9-1 (bookworm) |
| jfree | jfreechart | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
JFreeChart: XSS vulnerabilities in the image map feature
vendor_redhat·2007-12-06·CVSS 4.3
CVE-2007-6306 [MEDIUM] CWE-79 JFreeChart: XSS vulnerabilities in the image map feature
JFreeChart: XSS vulnerabilities in the image map feature
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
Debian
CVE-2007-6306: libjfreechart-java - Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in ...
vendor_debian·2007·CVSS 4.3
CVE-2007-6306 [MEDIUM] CVE-2007-6306: libjfreechart-java - Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in ...
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
Scope: local
bookworm: resolved (fixed in 1.0.9-1)
bullseye: resolved (fixed in 1.0.9-1)
forky: resolved (fixed in 1.0.9-1)
sid: resolved (fixed in 1.0.9-1)
trixie: resolved (fixed in 1.0.9-1)
GHSA
GHSA-2qpv-6w5r-q697: Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1
ghsa_unreviewed·2022-05-01
CVE-2007-6306 [MEDIUM] CWE-79 GHSA-2qpv-6w5r-q697: Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
OSV
CVE-2007-6306: Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1
osv·2007-12-11·CVSS 4.3
CVE-2007-6306 [MEDIUM] CVE-2007-6306: Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.1]
bugzilla·2008-01-15·CVSS 4.3
CVE-2007-6306 [MEDIUM] CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.1]
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.1]
rhn_satellite_4.1 tracking bug: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.
For the security issues handling process overview see: http://intranet.corp.redhat.com/ic/intranet/SecurityZStreamFAQ
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.0]
bugzilla·2008-01-15·CVSS 4.3
CVE-2007-6306 [MEDIUM] CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.0]
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.0]
rhn_satellite_4.0 tracking bug: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.
For the security issues handling process overview see: http://intranet.corp.redhat.com/ic/intranet/SecurityZStreamFAQ
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.2]
bugzilla·2008-01-15·CVSS 4.3
CVE-2007-6306 [MEDIUM] CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.2]
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature [rhn_satellite_4.2]
rhn_satellite_4.2 tracking bug: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.
For the security issues handling process overview see: http://intranet.corp.redhat.com/ic/intranet/SecurityZStreamFAQ
[bug automatically created by: add-tracking-bugs]
Discussion:
Built jfreechart-0.9.20-3.rhn.noarch.rpm (promoted from 5.0.2, where I fix it).
---
QA push for 4.2.3 complete: satellite-4.2.3-1 and proxy-4.2.3-1 are
now on webqa. Note that there is _no_ ISO planned for the 4.2.3
release.
Developers, please move your bugs ON_QA.
---
4.2.3 Satellite is now GA, bugs Closed for Current Releas
Bugzilla
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature
bugzilla·2007-12-12·CVSS 4.3
CVE-2007-6306 [MEDIUM] CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature
CVE-2007-6306 JFreeChart: XSS vulnerabilities in the image map feature
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6306 to the following vulnerability:
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.
References:
http://www.securityfocus.com/archive/1/archive/1/484709/100/0/threaded
http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662&r2=661&pathrev=662
http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=66
http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679&r2=680http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662&r2=661&pathrev=662http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662&r2=661&pathrev=662http://osvdb.org/41843http://osvdb.org/41844http://osvdb.org/41845http://rhn.redhat.com/errata/RHSA-2008-0630.htmlhttp://secunia.com/advisories/27959http://secunia.com/advisories/31493http://securityreason.com/securityalert/3430http://www.rapid7.com/advisories/R7-0031.jsphttp://www.redhat.com/support/errata/RHSA-2008-0151.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0158.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0213.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://www.securityfocus.com/archive/1/484709/100/0/threadedhttp://www.securityfocus.com/bid/26752https://exchange.xforce.ibmcloud.com/vulnerabilities/38922http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679&r2=680http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662&r2=661&pathrev=662http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662&r2=661&pathrev=662http://osvdb.org/41843http://osvdb.org/41844http://osvdb.org/41845http://rhn.redhat.com/errata/RHSA-2008-0630.htmlhttp://secunia.com/advisories/27959http://secunia.com/advisories/31493http://securityreason.com/securityalert/3430http://www.rapid7.com/advisories/R7-0031.jsphttp://www.redhat.com/support/errata/RHSA-2008-0151.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0158.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0213.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://www.securityfocus.com/archive/1/484709/100/0/threadedhttp://www.securityfocus.com/bid/26752https://exchange.xforce.ibmcloud.com/vulnerabilities/38922
2007-12-11
Published