CVE-2016-10537: XSS
Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the Model#Escape function, and the output is then written to the DOM.
The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as < into account.
Recommendation
Update to version 0.5.0 or later.
Other sources
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the Model#Escape function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as < to <.
Node.js backbone module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Model#Escape function. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2016-10537.
What is the severity of CVE-2016-10537?
The severity of CVE-2016-10537 is medium with a CVSS score of 6.1.
What software is affected by CVE-2016-10537?
Affected software includes Node.js Backbone module up to version 0.5.0, Backbone Project Backbone up to version 0.3.3, and IBM Security Verify Access Docker up to version 10.0.0.
How does CVE-2016-10537 work?
CVE-2016-10537 is a cross-site scripting (XSS) vulnerability caused by improper input validation in the Model#Escape function of Node.js Backbone module. An attacker could inject malicious script into a web page, which would then be executed in the victim's browser.
How can CVE-2016-10537 be fixed?
To fix CVE-2016-10537, it is recommended to upgrade to a version of the affected software that has a fix available. For example, upgrading Node.js Backbone module to version 0.5.0 or newer.