PT-2023-21150 · Unknown · Quickentity-Editor-Next

Atampy25 · Publicado 2023-03-06 · Atualizado 2023-03-11 · CVE-2023-27472

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions quickentity-editor-next versions prior to 1.28.1

Description The issue concerns an open source, system local, video game asset editor. In affected versions, HTML tags in entity names are not sanitized, leading to an XSS vulnerability. This allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag in any entity name.

Recommendations For versions prior to 1.28.1, upgrade to version 1.28.1 to resolve the issue. As a temporary workaround, consider avoiding the use of HTML tags in entity names until the upgrade is applied. Restrict access to files that may contain script tags in entity names to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-27472

GHSA-22GC-RQ5X-FXPW

Produtos afetados

Quickentity-Editor-Next

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27472.json · Exploit
• https://github.com/atampy25/quickentity-editor-next/security/advisories/GHSA-22gc-rq5x-fxpw · Nota
• https://github.com/atampy25/quickentity-editor-next/commit/5303b45a20a6e4e9318729b8dd7bbf09b37b369d · Correção
• https://t.me/cibsecurity/59505 · Publicação no Telegram
• https://t.me/cvenotify/45652 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27472 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27472 · Nota de Segurança