CVE-2016-10537: XSS

Reference Links

• https://nvd.nist.gov/vuln/detail/CVE-2016-10537
• https://github.com/jashkenas/backbone/commit/0cdc525961d3fa98e810ffae6bcc8e3838e36d93
• https://backbonejs.org/#changelog
• https://github.com/advisories/GHSA-j6p2-cx3w-6jcp (Advisory)
• https://www.npmjs.com/advisories/108
• https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008
• https://nodesecurity.io/advisories/108
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149143
• https://www.ibm.com/support/pages/node/6471895 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6471895

Frequently Asked Questions

• What is the vulnerability ID for this issue?

  The vulnerability ID for this issue is CVE-2016-10537.

• What is the severity of CVE-2016-10537?

  The severity of CVE-2016-10537 is medium with a CVSS score of 6.1.

• What software is affected by CVE-2016-10537?

  Affected software includes Node.js Backbone module up to version 0.5.0, Backbone Project Backbone up to version 0.3.3, and IBM Security Verify Access Docker up to version 10.0.0.

• How does CVE-2016-10537 work?

  CVE-2016-10537 is a cross-site scripting (XSS) vulnerability caused by improper input validation in the Model#Escape function of Node.js Backbone module. An attacker could inject malicious script into a web page, which would then be executed in the victim's browser.

• How can CVE-2016-10537 be fixed?

  To fix CVE-2016-10537, it is recommended to upgrade to a version of the affected software that has a fix available. For example, upgrading Node.js Backbone module to version 0.5.0 or newer.