PT-2019-11282 · Php League · Php League Commonmark Library

Mohit Fawaz + 2 · Published 2019-03-24 · Updated 2019-09-17 · CVE-2019-10010

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PHP League CommonMark library versions prior to 0.18.3

Description: The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to insert unsafe links into HTML. This is achieved by using double-encoded HTML entities that are not properly escaped during rendering.

Recommendations: For versions prior to 0.18.3, update to version 0.18.3 or later to resolve the issue. As a temporary workaround, consider disabling the rendering of user-provided HTML entities until a patch is available. Restrict access to the CommonMark library to minimize the risk of exploitation. Avoid using the library to render untrusted input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10010

GHSA-3V43-877X-QGMQ

Affected Products

Php League Commonmark Library

References · 9

• 🔥 https://github.com/thephpleague/commonmark/issues/353 · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10010 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10010 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3v43-877x-qgmq · Vendor Advisory
• https://github.com/thephpleague/commonmark · Note
• https://github.com/thephpleague/commonmark/releases/tag/0.18.3 · Note
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-3v43-877x-qgmq · Note
• https://github.com/advisories/GHSA-3v43-877x-qgmq · Note