PT-2019-18480 · Google · Cross Reference Add-On

Dcianciullio · Published 2019-01-31 · Updated 2019-02-01 · CVE-2019-7250

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cross Reference Add-on version 36 for Google Docs

Description An issue in the Cross Reference Add-on allows stored XSS in the preview boxes of the configuration panel. A malicious user can inject arbitrary JavaScript code using SCRIPT elements or event handlers via label text and references text. This code is stored by the plugin, potentially allowing the attacker to target anyone who opens the configuration panel.

Recommendations For Cross Reference Add-on version 36, consider disabling the preview boxes in the configuration panel until a fix is available to prevent potential exploitation. Restrict access to the configuration panel to minimize the risk of stored XSS attacks. Avoid using the label text and references text fields in the configuration panel until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-7250

Affected Products

Cross Reference Add-On

References · 3

• 🔥 https://github.com/davidrthorn/cross_reference/issues/32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7250 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7250 · Vendor Advisory