Описание
Cross site scripting in froala-editor
A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2020-22864
- https://github.com/froala/wysiwyg-editor/issues/3880
- https://github.com/418sec/wysiwyg-editor/pull/1
- https://github.com/froala/wysiwyg-editor/pull/3911
- https://github.com/froala/wysiwyg-editor/releases/tag/v4.0.11
- https://www.youtube.com/watch?v=WE3b1iSnWJY
Пакеты
Наименование
froala-editor
npm
Затронутые версииВерсия исправления
<= 4.0.6
4.0.11
Связанные уязвимости
CVSS3: 6.1
nvd
больше 4 лет назад
A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary web scripts or HTML.