Lucene search
GoogleOSV:GHSA-8V67-X8Q5-3X3GHistoryMay 14, 2019 - 4:01 a.m.
Cross-Site Scripting in simditor
2019-05-1404:01:27
Google
osv.dev
6
0.001 Low
EPSS
Percentile
49.3%
Versions of simditor prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with innerHTML, allowing attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 2.3.22 or later.
References
github.com/hkglue/simditor_demo.git
github.com/hkglue/simditor_dom_xss/blob/master/README.md
github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fd
github.com/mycolorway/simditor/releases/tag/v2.3.22
nvd.nist.gov/vuln/detail/CVE-2018-19048
snyk.io/vuln/SNYK-JS-SIMDITOR-174638
www.npmjs.com/advisories/884
Related
cvelist
cvelist
CVE-2018-19048
2019-05-13 13:13:27
nvd
nvd
CVE-2018-19048
2019-05-13 14:29:00
cve
cve
CVE-2018-19048
2019-05-13 14:29:00
veracode
veracode
Cross-site Scripting (XSS)
2019-05-14 04:54:40
github
github
Cross-Site Scripting in simditor
2019-05-14 04:01:27
prion
prion
Cross site scripting
2019-05-13 14:29:00
osv
osv
CVE-2018-19048
2019-05-13 14:29:00