PT-2021-24408 · Packagist · Ezsystems/Ezplatform-Admin-Ui

Published 2021-12-01 · Updated 2021-12-01

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, use: (affected versions not specified)

Description: The issue concerns the rich text editor, which fails to escape attribute data when previewing custom tags, allowing for XSS attacks. This can be exploited by users with access to editing rich text content to attack other editors. The frontend content view is not affected.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-9JP8-CWWX-P64Q

Affected Products

Ezsystems/Ezplatform-Admin-Ui

References · 4

• https://osv.dev/vulnerability/GHSA-9jp8-cwwx-p64q · Vendor Advisory
• https://github.com/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-9jp8-cwwx-p64q · Note
• https://github.com/ezsystems/ezplatform-admin-ui · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2021-010-xss-in-richtext-custom-tag-attributes · Note