Simditor XSS Vulnerability

Description

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.11

References

• GHSA-p9wj-wrrm-84m5
• CVE-2018-6464
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Uncaught Exception in yaml - CVE-2023-2251
• DLL Injection in kerberos - CVE-2020-13110
• Open Redirect in url-parse - CVE-2018-3774
• RSSHub SSRF vulnerability - CVE-2023-22493

Tags:

npm

simditor