Executive brief
Mirador is an open-source web-based image viewer used to display and compare digital images and annotations. Versions prior to 3.0.0 contain a cross-site scripting (XSS) vulnerability inherited from an outdated jQuery dependency, which could allow attackers to inject malicious scripts if Mirador is used to display untrusted image metadata or annotations. Users are advised to upgrade to Mirador v3.0.0 or later; no patches are available for the v2.x release line.
Technical details
This vulnerability is a cross-site scripting (CWE-79) flaw originating in an unpatched jQuery dependency used by Mirador versions prior to 3.0.0. The issue stems from jQuery versions before 3.5.0, which contained XSS weaknesses in DOM manipulation functions. The vulnerability is exploitable when Mirador processes untrusted image metadata, annotations, or configuration data from network sources. An attacker could craft malicious content that executes arbitrary JavaScript in the context of a user's browser session, potentially leading to credential theft or defacement. The issue is patched in Mirador 3.0.0 and later; no fixes are available for the v2.x branch, with the recommended mitigation being a full upgrade to v3.0.0.
Affected products
- ProjectMirador Mirador <3.0.0
Timeline
- 2020-09-17: disclosed