PT-2019-12083 · Erusev · Parsedown

Xpaw · Published 2019-04-06 · Updated 2022-03-26 · CVE-2019-10905

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parsedown versions prior to 1.7.2

Description The issue allows attackers to execute arbitrary JavaScript code if a script, already running on the affected page, executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, interfering with the intended behavior of a single class name beginning with the language- substring.

Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10905

GHSA-62M3-FC7F-JPP8

Affected Products

Parsedown

References · 7

• 🔥 https://github.com/erusev/parsedown/issues/699 · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/erusev/parsedown/CVE-2019-10905.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-62m3-fc7f-jpp8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10905 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10905 · Vendor Advisory
• https://github.com/erusev/parsedown/releases/tag/1.7.2 · Note
• https://github.com/erusev/parsedown · Note