Angular Redactor XSS Vulnerability

Description

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.6

References

• GHSA-88fh-8979-q2rr
• CVE-2018-13339
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• XSS vulnerability that affects bootstrap - bootstrap - CVE-2018-20676
• Ckeditor XSS Vulnerability - CVE-2018-17960
• SimpleMDE XSS Vulnerability - CVE-2018-19057
• Simditor XSS Vulnerability - CVE-2018-6464

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

angular-redactor