PT-2019-18068 · Jpress · Jpress

Published 2019-01-14 · Updated 2019-01-18 · CVE-2019-6278

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JPress version 1.0.4

Description The issue exists due to XSS in Markdown input, which can also be triggered when using the code input option.

Recommendations For JPress version 1.0.4, consider disabling Markdown input or restricting the use of the code input option as a temporary workaround until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-6278

Affected Products

Jpress

References · 3

• 🔥 https://gitee.com/fuhai/jpress/issues/IQUXE · Exploit
• https://osv.dev/vulnerability/CVE-2019-6278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6278 · Security Note