Lucene search

SnykCVE-2020-28455

HistoryJul 25, 2022 - 2:15 p.m.

CVE-2020-28455

2022-07-2514:15:09

CWE-79

snyk

web.nvd.nist.gov

cve-2020-28455

markdown

security

escaping

vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C

EPSS

0.001

Percentile

40.2%

JSON

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.

Affected configurations

Nvd

Node

markdown-it-toc_projectmarkdown-it-tocnode.js

VendorProductVersionCPE
markdown-it-toc_projectmarkdown-it-toc*cpe:2.3:a:markdown-it-toc_project:markdown-it-toc:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
markdown-it-toc_project	markdown-it-toc	*	cpe:2.3:a:markdown-it-toc_project:markdown-it-toc::::::node.js::*

CNA Affected

[
  {
    "product": "markdown-it-toc",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067

Social References

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C

EPSS

0.001

Percentile

40.2%

JSON

Related for CVE-2020-28455