Lucene search

GitHub Advisory DatabaseGHSA-M5JF-8CRM-R65M

HistoryMay 03, 2024 - 6:30 p.m.

Vditor allows Cross-site Scripting via an attribute of an `A` element

2024-05-0318:30:37

CWE-79

GitHub Advisory Database

github.com

vditor

xss

cross-site scripting

attribute

'a' element

sanitize=true

software

AI Score

5.9

Confidence

High

EPSS

Percentile

9.0%

Vditor 3.10.3 allows XSS via an attribute of an A element.

NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.

Affected configurations

Vulners

Node

b3logvditorMatch3.10.3

VendorProductVersionCPE
b3logvditor3.10.3cpe:2.3:a:b3log:vditor:3.10.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
b3log	vditor	3.10.3	cpe:2.3:a:b3log:vditor:3.10.3:::::::*

github.com/advisories/GHSA-m5jf-8crm-r65m

github.com/Vanessa219/vditor/blob/b3a14d6e4462b0c17141e1fcc66173264ada64e0/README_en_US.md?plain=1#L310

github.com/Vanessa219/vditor/issues/1604

nvd.nist.gov/vuln/detail/CVE-2024-34449