PT-2019-11282 · Php League · Php League Commonmark Library

Mohit Fawaz + 2 · Publicado 2019-03-24 · Atualizado 2019-09-17 · CVE-2019-10010

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PHP League CommonMark library versions prior to 0.18.3

Description: The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to insert unsafe links into HTML. This is achieved by using double-encoded HTML entities that are not properly escaped during rendering.

Recommendations: For versions prior to 0.18.3, update to version 0.18.3 or later to resolve the issue. As a temporary workaround, consider disabling the rendering of user-provided HTML entities until a patch is available. Restrict access to the CommonMark library to minimize the risk of exploitation. Avoid using the library to render untrusted input until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10010

GHSA-3V43-877X-QGMQ

Produtos afetados

Php League Commonmark Library

Referências · 9

• 🔥 https://github.com/thephpleague/commonmark/issues/353 · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml · Exploit
• https://github.com/thephpleague/commonmark · Nota
• https://github.com/thephpleague/commonmark/releases/tag/0.18.3 · Nota
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-3v43-877x-qgmq · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10010 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10010 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3v43-877x-qgmq · Aviso do Fabricante
• https://github.com/advisories/GHSA-3v43-877x-qgmq · Nota