Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04OGZoLTg5NzktcTJycs4AAWaW
Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
Permalink: https://github.com/advisories/GHSA-88fh-8979-q2rrJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OGZoLTg5NzktcTJycs4AAWaW
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 8 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-88fh-8979-q2rr, CVE-2018-13339
References:
- https://nvd.nist.gov/vuln/detail/CVE-2018-13339
- https://github.com/TylerGarlick/angular-redactor/issues/77
- https://github.com/gleez/cms/issues/796
- https://github.com/advisories/GHSA-88fh-8979-q2rr
Blast Radius: 1.8
Affected Packages
npm:angular-redactor
Dependent packages: 2Dependent repositories: 2
Downloads: 1,028 last month
Affected Version Ranges: <= 1.1.6
No known fixed version
All affected versions: 1.1.5