exploitDog

CVE-2022-23474

Опубликовано: 15 дек. 2022

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Ссылки

https://github.com/codex-team/editor.js/pull/2100
Exploit
Patch
Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/
Exploit
Patch
Third Party Advisory
https://github.com/codex-team/editor.js/pull/2100
Exploit
Patch
Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:codex:editor.js:*:*:*:*:*:node.js:*:*

Версия до 2.26.0 (исключая)

EPSS

Процентиль: 58%

0.00364

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-94

CWE-79

Связанные уязвимости

GHSA-6mvj-2569-3mcm

CVSS3: 6.1

github

больше 1 года назад

Editor.js vulnerable to Code Injection

EPSS

Процентиль: 58%

0.00364

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-94

CWE-79