PT-2017-12127 · None · Markdown Preview Plus

Framartin · Publicado 2017-07-24 · Atualizado 2017-08-10 · CVE-2017-11593

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Markdown Preview Plus extension versions prior to 0.5.7

Description The issue allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files. These files are designed to be viewed in the browser as plain text but will be converted to HTML without proper sanitization, leading to a cross-site scripting (XSS) issue.

Recommendations For versions prior to 0.5.7, update to version 0.5.7 or later to resolve the issue. As a temporary workaround, consider disabling the Markdown Preview Plus extension until a patch is available. Restrict access to uploading and displaying crafted files to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-11593

Produtos afetados

Markdown Preview Plus

Referências · 4

• 🔥 https://github.com/volca/markdown-preview/issues/60 · Exploit
• https://github.com/volca/markdown-preview/commit/1181f044a5457d5e1ac35804ecd84e05977f1920 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11593 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11593 · Nota de Segurança