Cross Site Scripting (XSS)

2024-07-1605:08:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

url sanitization

mediaembedelement

urlparsers

javascript

data

vbscript

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.4

Confidence

High

JSON

@udecode/plate-media is vulnerable to Cross Site Scripting (XSS). The vulnerability is due to lack of proper URL sanitization in MediaEmbedElement and custom urlParsers and direct consumption of the url property, which allows an attacker to embed malicious URLs using javascript:, data:, or vbscript: schemes.