CVE-2022-23461 Cross-Site Scripting (XSS) in Jodit Editor

2022-09-2403:05:08

CWE-79

GitHub_M

www.cve.org

cve-2022-23461

cross-site scripting

jodit editor

typescript

xss attacks

input validation

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.0%

JSON

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

CNA Affected

[
  {
    "product": "Jodit Editor",
    "vendor": "xdan",
    "versions": [
      {
        "lessThanOrEqual": "3.20.4",
        "status": "affected",
        "version": "3.20.4",
        "versionType": "custom"
      }
    ]
  }
]