PT-2021-23078 · Jsuites · Jsuites

Bananabr + 2 · Published 2021-09-21 · Updated 2021-09-29 · CVE-2021-41086

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsuites versions prior to 4.9.11

Description The issue allows for cross-site scripting (XSS) attacks via clipboard content. If a user can be tricked into copying malicious content and pasting it into the HTML editor, a part of the clipboard content is directly written to innerHTML, causing XSS. This enables JavaScript injection.

Recommendations For versions prior to 4.9.11, update to version 4.9.11 to resolve the issue. As a temporary workaround, consider restricting the use of the HTML editor until the update is applied. Avoid pasting arbitrary content from untrusted sources into the HTML editor to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41086

GHSA-QH7X-J4V8-QW5W

Affected Products

Jsuites

References · 9

• https://github.com/jsuites/jsuites/commit/d47a6f4e143188dde2742f4cffd313e1068ad3b3 · Patch
• https://github.com/jsuites/jsuites/commit/fe1d3cc5e339f2f4da8ed1f9f42271fdf9cbd8d2 · Patch
• https://osv.dev/vulnerability/CVE-2021-41086 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh7x-j4v8-qw5w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41086 · Security Note
• https://github.com/jsuites/jsuites/security/advisories/GHSA-qh7x-j4v8-qw5w · Note
• https://github.com/jsuites/jsuites · Note
• https://npmjs.com/package/jsuites · Note
• https://t.me/cibsecurity/29208 · Telegram Post