PT-2022-16003 · Unknown · Jodit Editor

Bananabr + 5 · Published 2022-09-24 · Updated 2022-09-27 · CVE-2022-23461

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jodit Editor (affected versions not specified)

Description Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. It is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23461

GHSA-42HX-VRXX-5R6V

Affected Products

Jodit Editor

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23461.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-030_xdan_jodit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23461 · Security Note
• https://osv.dev/vulnerability/GHSA-42hx-vrxx-5r6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23461 · Vendor Advisory
• https://github.com/xdan/jodit · Note
• https://t.me/cvenotify/36791 · Telegram Post
• https://t.me/cibsecurity/50430 · Telegram Post