PT-2018-17561 · Pagekit · Simditor

Published 2018-01-31 · Updated 2022-05-13 · CVE-2018-6464

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simditor version 2.3.11

Description The issue allows for XSS via crafted use of svg/onload=alert in a TEXTAREA element. This has been demonstrated using Firefox 54.0.1.

Recommendations For Simditor version 2.3.11, consider disabling the use of SVG elements in TEXTAREA fields until a patch is available. Restrict access to the TEXTAREA element to minimize the risk of exploitation. Avoid using the onload event in SVG elements within the TEXTAREA element until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-6464

GHSA-P9WJ-WRRM-84M5

Affected Products

Simditor

References · 5

• 🔥 https://github.com/Heartway/simditor/blob/master/simditor.docx · Exploit
• https://osv.dev/vulnerability/GHSA-p9wj-wrrm-84m5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6464 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6464 · Vendor Advisory
• https://github.com/Heartway/simditor · Note