Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.
References
| Link | Resource |
|---|---|
| https://github.com/jbt/markdown-editor/issues/106 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/jbt/markdown-editor/commit/228f1947a5242a6fbe2995d72d21b7e5f5178f35 | Patch |
| https://github.com/jbt/markdown-editor/pull/110 | Patch |
Configurations
History
18 Aug 2023, 18:14
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| References | (MISC) https://github.com/jbt/markdown-editor/pull/110 - Patch | |
| References | (CONFIRM) https://github.com/jbt/markdown-editor/commit/228f1947a5242a6fbe2995d72d21b7e5f5178f35 - Patch | |
| References | (MISC) https://github.com/jbt/markdown-editor/issues/106 - Exploit, Issue Tracking, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Jbt live \(github-flavored\) Markdown Editor
Jbt |
|
| CPE | cpe:2.3:a:jbt:live_\(github-flavored\)_markdown_editor:*:*:*:*:*:*:*:* |
11 Aug 2023, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-11 14:15
Updated : 2023-08-18 18:14
NVD link : CVE-2020-19952
Mitre link : CVE-2020-19952
JSON object : View
Products Affected
jbt
- live_\(github-flavored\)_markdown_editor
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')