PT-2019-15887 · Documize · Documize

Publicado 2019-12-06 · Atualizado 2021-05-18 · CVE-2019-19619

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Documize versions prior to 3.5.1

Description The issue arises from the mishandling of untrusted Markdown content, which can lead to potential XSS attacks if the content is used to render untrusted user input. This is due to the lack of proper sanitization of HTML content in markdown during rendering. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions prior to 3.5.1, update to version 3.5.1 or later, which includes the addition of the bluemonday HTML sanitizer to defend against XSS attacks.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19619

GHSA-WMWP-PGGC-H4MJ

GO-2021-0086

Produtos afetados

Documize

Referências · 9

• https://github.com/documize/community/releases/tag/v3.5.1 · Nota
• https://github.com/documize/community/commit/a4384210d4d0d6b18e6fdb7e155de96d4a1cf9f3 · Correção
• https://github.com/documize/community/compare/v3.5.0...v3.5.1 · Nota
• https://github.com/documize/community · Nota
• https://osv.dev/vulnerability/CVE-2019-19619 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19619 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-wmwp-pggc-h4mj · Aviso do Fabricante
• https://pkg.go.dev/vuln/GO-2021-0086 · Nota
• https://osv.dev/vulnerability/GO-2021-0086 · Aviso do Fabricante