PT-2022-4453 · Unknown · Mobiledoc-Kit

Published 2022-08-22 · Updated 2022-08-23 · CVE-2022-2932

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions mobiledoc-kit versions prior to 0.14.2

Description The issue is related to a Cross-site Scripting (XSS) vulnerability, specifically a Reflected XSS. This occurs due to insufficient protection of the web page structure in the Mobiledoc Kit WYSIWYG editor. Exploitation of this issue could allow a remote attacker to conduct an XSS attack.

Recommendations For versions prior to 0.14.2, update to version 0.14.2 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-05318

CVE-2022-2932

GHSA-HW2P-XQHQ-3MJF

Affected Products

Mobiledoc-Kit

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2932.json · Exploit
• 🔥 https://huntr.dev/bounties/2-other-bustle/mobiledoc-kit · Exploit
• https://github.com/bustle/mobiledoc-kit/commit/f3fdaa5352904fd2a0b4247ccb0dbf68aad43b5a · Patch
• https://osv.dev/vulnerability/CVE-2022-2932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2932 · Security Note
• https://osv.dev/vulnerability/GHSA-hw2p-xqhq-3mjf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05318 · Security Note
• https://github.com/bustle/mobiledoc-kit · Note