PT-2020-7656 · Marked · Marked

Published 2020-01-06 · Updated 2020-08-31 · CVE-2014-3743

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Marked module versions prior to 0.3.1

Description Multiple cross-site scripting (XSS) vulnerabilities in the Marked module allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's. Even if the sanitize: true option is set, marked is vulnerable to content injection in multiple locations if untrusted user input is allowed to be provided into marked and that output is passed to the browser. Injection is possible in two locations: gfm codeblocks (language) and javascript url's.

Recommendations Upgrade to version 0.3.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3743

GHSA-9CW2-JQP5-7X39

Affected Products

Marked

References · 16

• https://osv.dev/vulnerability/GHSA-9cw2-jqp5-7x39 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3743 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3743 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3743 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3743 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-1850 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3743 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3743 · Vendor Advisory
• https://web.archive.org/web/20150502141648/https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities · Note
• https://npmjs.com/advisories/22 · Note
• http://openwall.com/lists/oss-security/2014/05/13/1 · Note
• http://openwall.com/lists/oss-security/2014/05/15/2 · Note
• https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities · Note
• http://openwall.com/lists/oss-security/2014/05/14 · Note