CVE-2019-20903

2020-10-0101:30:19

atlassian

www.cve.org

atlaskit

editor-core

version 113.1.5

remote attackers

inject

html

javascript

cross-site scripting

xss

vulnerability

link targets

EPSS

0.001

Percentile

36.0%

JSON

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.

CNA Affected

[
  {
    "product": "@atlaskit/editor-core",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "113.1.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]