PT-2023-11542 · Unknown · Jbt Markdown Editor

Colebennett · Publicado 2023-08-11 · Atualizado 2023-08-18 · CVE-2020-19952

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jbt Markdown Editor versions prior to commit 2252418c27dffbb35147acd8ed324822b8919477

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the Rendering Engine of the jbt Markdown Editor. This vulnerability allows remote attackers to execute arbitrary code via a crafted payload or by opening a malicious .md file.

Recommendations For versions prior to commit 2252418c27dffbb35147acd8ed324822b8919477, consider disabling the Rendering Engine feature until a patch is available. Restrict access to malicious .md files to minimize the risk of exploitation. Avoid using crafted payloads in the affected Rendering Engine until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-19952

Produtos afetados

Jbt Markdown Editor

Referências · 8

• 🔥 https://github.com/jbt/markdown-editor/issues/106 · Exploit
• https://github.com/jbt/markdown-editor/pull/110 · Correção
• https://github.com/jbt/markdown-editor/commit/228f1947a5242a6fbe2995d72d21b7e5f5178f35 · Correção
• https://t.me/cibsecurity/68359 · Publicação no Telegram
• https://t.me/cvenotify/56273 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-19952 · Nota de Segurança
• https://twitter.com/CVEnew/status/1690263971696185344 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2020-19952 · Aviso do Fabricante