GHSA-h236-g5gh-vq6c

    Dashboard / Vulnerabilities / GHSA-h236-g5gh-vq6c

    GHSA-h236-g5gh-vq6c

    Published: 10 Feb 2022Last Modified: 8 Nov 2023

    Summary: DOM-based cross-site scripting in Froala Editor

    Details: Froala WYSIWYG HTML Editor is a lightweight WYSIWYG HTML Editor written in JavaScript that enables rich text editing capabilities for web applications. A DOM-based cross-site scripting (XSS) vulnerability exists in versions before 3.2.3 because HTML code in the editor is not correctly sanitized when inserted into the DOM. This allows an attacker that can control the editor content to execute arbitrary JavaScript in the context of the victim’s session.

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-19935, https://blog.compass-security.com/2020/07/yet-another-froala-0-day-xss, https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2020-004_DOM_XSS_in_Froala_WYSIWYG_HTML_Editor.txt, https://froala.com/wysiwyg-editor/changelog/#3.2.3, https://github.com/froala/wysiwyg-editor-release, https://github.com/froala/wysiwyg-editor/compare/v3.0.5...v3.0.6, https://snyk.io/vuln/npm:froala-editor, http://packetstormsecurity.com/files/158300/Froala-WYSIWYG-HTML-Editor-3.1.1-Cross-Site-Scripting.html

    Affected packages

    Package

    Name: froala-editor

    Purl: pkg:npm/froala-editor

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.2.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-h236-g5gh-vq6c | CVE-DB