PT-2017-12127 · None · Markdown Preview Plus

Framartin · Published 2017-07-24 · Updated 2017-08-10 · CVE-2017-11593

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Markdown Preview Plus extension versions prior to 0.5.7

Description The issue allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files. These files are designed to be viewed in the browser as plain text but will be converted to HTML without proper sanitization, leading to a cross-site scripting (XSS) issue.

Recommendations For versions prior to 0.5.7, update to version 0.5.7 or later to resolve the issue. As a temporary workaround, consider disabling the Markdown Preview Plus extension until a patch is available. Restrict access to uploading and displaying crafted files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-11593

Affected Products

Markdown Preview Plus

References · 4

• 🔥 https://github.com/volca/markdown-preview/issues/60 · Exploit
• https://github.com/volca/markdown-preview/commit/1181f044a5457d5e1ac35804ecd84e05977f1920 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11593 · Security Note