PT-2019-15887 · Documize · Documize

Published 2019-12-06 · Updated 2021-05-18 · CVE-2019-19619

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Documize versions prior to 3.5.1

Description The issue arises from the mishandling of untrusted Markdown content, which can lead to potential XSS attacks if the content is used to render untrusted user input. This is due to the lack of proper sanitization of HTML content in markdown during rendering. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions prior to 3.5.1, update to version 3.5.1 or later, which includes the addition of the bluemonday HTML sanitizer to defend against XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19619

GHSA-WMWP-PGGC-H4MJ

GO-2021-0086

Affected Products

Documize

References · 9

• https://github.com/documize/community/commit/a4384210d4d0d6b18e6fdb7e155de96d4a1cf9f3 · Patch
• https://osv.dev/vulnerability/CVE-2019-19619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19619 · Security Note
• https://osv.dev/vulnerability/GHSA-wmwp-pggc-h4mj · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0086 · Vendor Advisory
• https://github.com/documize/community/releases/tag/v3.5.1 · Note
• https://github.com/documize/community/compare/v3.5.0...v3.5.1 · Note
• https://github.com/documize/community · Note
• https://pkg.go.dev/vuln/GO-2021-0086 · Note