PT-2019-12083 · Erusev · Parsedown

Xpaw · Publicado 2019-04-06 · Atualizado 2022-03-26 · CVE-2019-10905

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parsedown versions prior to 1.7.2

Description The issue allows attackers to execute arbitrary JavaScript code if a script, already running on the affected page, executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, interfering with the intended behavior of a single class name beginning with the language- substring.

Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10905

GHSA-62M3-FC7F-JPP8

Produtos afetados

Parsedown

Referências · 7

• 🔥 https://github.com/erusev/parsedown/issues/699 · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/erusev/parsedown/CVE-2019-10905.yaml · Exploit
• https://github.com/erusev/parsedown/releases/tag/1.7.2 · Nota
• https://github.com/erusev/parsedown · Nota
• https://osv.dev/vulnerability/GHSA-62m3-fc7f-jpp8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10905 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10905 · Aviso do Fabricante