PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5964 Openenergymonitor CVE debrief

CVE-2017-5964 is a cross-site scripting issue in Emoncms through 9.8.0. The problem is tied to insufficient filtering of user-supplied HTTP GET parameters in the compare.php visualization endpoint, allowing attacker-controlled HTML or script to run in the context of the vulnerable site. NVD rates the issue as medium severity with network reachability, no privileges required, and user interaction required.

Vendor
Openenergymonitor
Product
Emoncms
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-12
Original CVE updated
2026-05-13
Advisory published
2017-02-12
Advisory updated
2026-05-13

Who should care

Operators and administrators running Emoncms through 9.8.0, especially installations where the compare.php visualization is reachable by normal users or exposed in a browser-facing workflow. Security teams should also care if the deployment relies on browser session trust, shared dashboards, or user-generated links.

Technical summary

The NVD record classifies this as CWE-79 (XSS) with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The affected surface is emoncms-master/Modules/vis/visualisations/compare.php, where multiple HTTP GET parameters are insufficiently filtered before being rendered back into the page. Because the flaw executes in the browser context of the vulnerable website, it can affect session-bound actions and page content integrity for users who open a crafted link or otherwise reach the vulnerable endpoint.

Defensive priority

Medium. The vulnerability requires user interaction, but it is network-reachable and can impact both confidentiality and integrity within the browser session context.

Recommended defensive actions

  • Inventory Emoncms deployments and confirm whether any instance is at or below version 9.8.0.
  • Upgrade to a fixed Emoncms release if available, or apply the vendor remediation referenced in the linked GitHub issue.
  • Review compare.php and related visualization handlers for output encoding and strict parameter validation.
  • Add or tighten browser-side defenses such as a restrictive Content Security Policy where feasible.
  • Check logs and user-facing links for suspicious compare.php requests containing unexpected parameter values.
  • Retest the affected endpoint after remediation to confirm that untrusted input is no longer reflected unsafely.

Evidence notes

The vulnerability description and version scope come from the official NVD record for CVE-2017-5964, which lists Emoncms through 9.8.0 and identifies CWE-79. The NVD CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a browser-mediated XSS issue with network reachability and no privileges required. NVD also links a GitHub issue in the Emoncms repository as a vendor advisory/patch reference, and a SecurityFocus BID entry as a third-party advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5964 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5964

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5964 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5964

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.