PT-2018-17561 · Pagekit · Simditor

Publicado 2018-01-31 · Atualizado 2022-05-13 · CVE-2018-6464

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simditor version 2.3.11

Description The issue allows for XSS via crafted use of svg/onload=alert in a TEXTAREA element. This has been demonstrated using Firefox 54.0.1.

Recommendations For Simditor version 2.3.11, consider disabling the use of SVG elements in TEXTAREA fields until a patch is available. Restrict access to the TEXTAREA element to minimize the risk of exploitation. Avoid using the onload event in SVG elements within the TEXTAREA element until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-6464

GHSA-P9WJ-WRRM-84M5

Produtos afetados

Simditor

Referências · 5

• 🔥 https://github.com/Heartway/simditor/blob/master/simditor.docx · Exploit
• https://github.com/Heartway/simditor · Nota
• https://osv.dev/vulnerability/GHSA-p9wj-wrrm-84m5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6464 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6464 · Aviso do Fabricante