ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16470 advisory.

  - ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1,     using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution.
    It affects the popular data visualization library Apache ECharts, which uses and exports these two methods     directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue     is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the     object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge`     and `setOption` if project is using ECharts. (CVE-2021-39227)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1,
    using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution.
    It affects the popular data visualization library Apache ECharts, which uses and exports these two methods
    directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue
    is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the
    object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge`
    and `setOption` if project is using ECharts. (CVE-2021-39227)

ID	Name	Product	Family	Severity
293764	Atlassian Jira Service Management Data Center and Server 10.3.x< 10.3.14 / 11.0.x < 11.3.0 (JSDSERVER-16470)	Nessus	Misc.	critical
414536	SCA: security update for zrender (GHSA-fhv8-fx5f-7fxf)	Tenable Cloud Security	SCA Checks	critical
414536	SCA: security update for zrender (GHSA-fhv8-fx5f-7fxf)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2021-39227

critical

Tenable Plugins

critical

critical

critical