Stored XSS Vulnerability in Imperavi Redactor 3 for Angular Redactor
CVE-2018-13339

6.1MEDIUM

Key Information:

Vendor

Angular Redactor Project

Status
Angular Redactor
Vendor
CVE Published:
5 July 2018

What is CVE-2018-13339?

The Imperavi Redactor 3 in Angular Redactor 1.1.6 contains a vulnerability that allows for stored Cross-Site Scripting (XSS) when HTML content mode is enabled. This security flaw can be exploited through malicious input, such as an 'onerror' attribute in an IMG element, potentially enabling an attacker to execute arbitrary JavaScript in the context of the user's browser. This issue highlights the importance of validating and sanitizing user inputs to safeguard web applications from potential exploits.

References

https://github.com/gleez/cms/issues/796
x_refsource_MISC
https://github.com/TylerGarlick/angular-redactor/issues/77
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.