PT-2021-24417 · Packagist · Ezsystems/Ezplatform-Richtext

Published 2021-12-01 · Updated 2021-12-01

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, use: (affected versions not specified)

Description: The issue concerns the rich text editor, which fails to escape attribute data when previewing custom tags. This allows for potential XSS attacks if custom tags are used, specifically targeting users with access to editing rich text content. The frontend content view is not affected, but the vulnerability could be exploited by editors to attack other editors.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-FXWM-RX68-P5VX

Affected Products

Ezsystems/Ezplatform-Richtext

References · 5

• https://osv.dev/vulnerability/GHSA-fxwm-rx68-p5vx · Vendor Advisory
• https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-fxwm-rx68-p5vx · Note
• https://github.com/ezsystems/ezplatform-richtext/commit/3cebfe2ae4c22e6590632a0ff71893854a16afc5 · Note
• https://github.com/ezsystems/ezplatform-richtext · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2021-010-xss-in-richtext-custom-tag-attributes · Note