PT-2019-19892 · None · Simple-Markdown

Jedixak · Published 2019-03-15 · Updated 2019-04-15 · CVE-2019-9844

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.4.4

Description The issue is related to insufficient input sanitization, which allows Cross-Site Scripting (XSS) attacks. This can be exploited through input of links containing data or vbscript URIs and a base64-encoded payload.

Recommendations Upgrade to version 0.4.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-9844

GHSA-QJ3F-9GMQ-FWV5

Affected Products

Simple-Markdown

References · 14

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9844 · Security Note
• https://osv.dev/vulnerability/GHSA-qj3f-9gmq-fwv5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9844 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG · Vendor Advisory
• https://github.com/Khan/simple-markdown/pull/63 · Note
• https://github.com/Khan/simple-markdown · Note
• https://npmjs.com/advisories/815 · Note
• https://npmjs.com/package/simple-markdown/v/0.4.4 · Note
• https://github.com/advisories/GHSA-qj3f-9gmq-fwv5 · Note