CVE-2021-43635

Опубликовано: 04 фев. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.

Ссылки

https://github.com/jcv8000/Codex
Product
Third Party Advisory
https://github.com/jcv8000/Codex/issues/8
Exploit
Third Party Advisory
https://github.com/jcv8000/Codex/releases/tag/v1.4.1
Release Notes
Third Party Advisory
https://github.com/jcv8000/Codex
Product
Third Party Advisory
https://github.com/jcv8000/Codex/issues/8
Exploit
Third Party Advisory
https://github.com/jcv8000/Codex/releases/tag/v1.4.1
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:codexnotes:codex:*:*:*:*:*:*:*:*

Версия до 1.4.0 (исключая)

EPSS

Процентиль: 79%

0.01302

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c33v-j96v-576w