PT-2019-18480 · Google · Cross Reference Add-On

Dcianciullio · Publicado 2019-01-31 · Atualizado 2019-02-01 · CVE-2019-7250

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cross Reference Add-on version 36 for Google Docs

Description An issue in the Cross Reference Add-on allows stored XSS in the preview boxes of the configuration panel. A malicious user can inject arbitrary JavaScript code using SCRIPT elements or event handlers via label text and references text. This code is stored by the plugin, potentially allowing the attacker to target anyone who opens the configuration panel.

Recommendations For Cross Reference Add-on version 36, consider disabling the preview boxes in the configuration panel until a fix is available to prevent potential exploitation. Restrict access to the configuration panel to minimize the risk of stored XSS attacks. Avoid using the label text and references text fields in the configuration panel until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-7250

Produtos afetados

Cross Reference Add-On

Referências · 3

• 🔥 https://github.com/davidrthorn/cross_reference/issues/32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7250 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-7250 · Aviso do Fabricante