PT-2019-19892 · None · Simple-Markdown

Jedixak · Publicado 2019-03-15 · Atualizado 2019-04-15 · CVE-2019-9844

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.4.4

Description The issue is related to insufficient input sanitization, which allows Cross-Site Scripting (XSS) attacks. This can be exploited through input of links containing data or vbscript URIs and a base64-encoded payload.

Recommendations Upgrade to version 0.4.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-9844

GHSA-QJ3F-9GMQ-FWV5

Produtos afetados

Simple-Markdown

Referências · 14

• https://github.com/Khan/simple-markdown/pull/63 · Nota
• https://github.com/Khan/simple-markdown · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9844 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qj3f-9gmq-fwv5 · Aviso do Fabricante
• https://npmjs.com/advisories/815 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG · Aviso do Fabricante
• https://npmjs.com/package/simple-markdown/v/0.4.4 · Nota
• https://github.com/advisories/GHSA-qj3f-9gmq-fwv5 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-9844 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG · Aviso do Fabricante