PT-2023-11542 · Unknown · Jbt Markdown Editor

Colebennett · Published 2023-08-11 · Updated 2023-08-18 · CVE-2020-19952

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jbt Markdown Editor versions prior to commit 2252418c27dffbb35147acd8ed324822b8919477

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the Rendering Engine of the jbt Markdown Editor. This vulnerability allows remote attackers to execute arbitrary code via a crafted payload or by opening a malicious .md file.

Recommendations For versions prior to commit 2252418c27dffbb35147acd8ed324822b8919477, consider disabling the Rendering Engine feature until a patch is available. Restrict access to malicious .md files to minimize the risk of exploitation. Avoid using crafted payloads in the affected Rendering Engine until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-19952

Affected Products

Jbt Markdown Editor

References · 8

• 🔥 https://github.com/jbt/markdown-editor/issues/106 · Exploit
• https://github.com/jbt/markdown-editor/pull/110 · Patch
• https://github.com/jbt/markdown-editor/commit/228f1947a5242a6fbe2995d72d21b7e5f5178f35 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-19952 · Security Note
• https://osv.dev/vulnerability/CVE-2020-19952 · Vendor Advisory
• https://t.me/cibsecurity/68359 · Telegram Post
• https://t.me/cvenotify/56273 · Telegram Post
• https://twitter.com/CVEnew/status/1690263971696185344 · Twitter Post