SimpleMDE XSS Vulnerability

Description

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.11.2

References

• GHSA-wg85-p6j7-gp3w
• CVE-2018-19057
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• XSS vulnerability that affects bootstrap - CVE-2018-20676
• XSS vulnerability that affects bootstrap - bootstrap - CVE-2018-20676
• Simditor XSS Vulnerability - CVE-2018-6464
• Ckeditor XSS Vulnerability - CVE-2018-17960

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

simplemde