vditor vulnerable to Cross-site Scripting
CVE-2021-32855

6.1MEDIUM

Key Information:

Vendor

Npm

Status
Vditor
Vendor
CVE Published:
21 February 2023

What is CVE-2021-32855?

Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.

Affected Version(s)

vditor 3.8.7

References

https://securitylab.github.com/advisories/GHSL-2021-1006-...
https://github.com/Vanessa219/vditor/issues/1085
https://github.com/Vanessa219/vditor/commit/1b2382d7f8a4e...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.