CVE-2018-19048: Cross-Site Scripting in simditor
Summary
CVE-2018-19048: Cross-Site Scripting in simditor. Affects simditor versions < 2.3.22. Fixed in 2.3.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Simditor is an npm package that provides a simple yet powerful WYSIWYG editor for web applications. It allows users to input and format text content with ease. However, versions prior to 2.3.22 are susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability arises from the package's failure to properly sanitize user input that is rendered with innerHTML. As a result, attackers can execute arbitrary JavaScript code on the affected web application.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in simditor allows attackers to inject malicious JavaScript code into the web application. This can lead to various security risks, such as unauthorized access to user data, session hijacking, defacement of the website, or the execution of other malicious actions on behalf of the user. The vulnerability is rated as moderate severity with a CVSS score of 6.1. It is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
2.3.22
This is the first release that contains the fix.
npm install simditor@2.3.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Cross-Site Scripting vulnerability in simditor versions prior to 2.3.22 poses a moderate security risk, allowing attackers to execute arbitrary JavaScript code on affected web applications. To mitigate this vulnerability, it is crucial to upgrade to version 2.3.22 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simditor →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code on the affected web application, potentially leading to unauthorized access, data theft, or other malicious activities.
At the moment, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the simditor package.
No, only versions prior to 2.3.22 are affected. It is crucial to update to the latest version to mitigate the vulnerability.
There is no specific evidence of active exploits targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent potential attacks.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-8v67-x8q5-3x3g or the associated CVE-2018-19048.
References
Related vulnerabilities
Recent vulnerabilities recorded for simditor.
