CVE-2021-42228: Cross Site Request Forgery in kindeditor
Summary
CVE-2021-42228: Cross Site Request Forgery in kindeditor. Affects kindeditor versions < 4.1.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
KindEditor is an npm package that provides a Google editor for websites. It allows users to upload and edit HTML files. However, KindEditor 4.1.x is vulnerable to a Cross Site Request Forgery (CSRF) attack. This means that an attacker can upload a malicious HTML file containing CSRF code to a website using KindEditor. By tricking users into clicking a malicious link, the attacker can exploit the authority of the website to perform unauthorized actions on behalf of the user.
Vulnerability Detail
The CSRF vulnerability in KindEditor 4.1.x allows an attacker to execute unauthorized actions on a website using the authority of the website. By uploading a malicious HTML file containing CSRF code, the attacker can trick users into performing actions without their consent. This can lead to various security risks, such as unauthorized data modification, account hijacking, or spreading malware.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update KindEditor to the latest version to mitigate the CSRF risk.
Conclusion
The CSRF vulnerability in KindEditor 4.1.x poses a significant security risk as it allows attackers to perform unauthorized actions on a website. To mitigate this risk, it is essential to update KindEditor to version 4.1.13 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kindeditor →
FAQ
KindEditor is an npm package that provides a Google editor for websites. It allows users to upload and edit HTML files.
A CSRF vulnerability allows an attacker to perform unauthorized actions on a website using the authority of the website. By tricking users into performing actions without their consent, the attacker can exploit the vulnerability.
An attacker can upload a malicious HTML file containing CSRF code to a website using KindEditor. By tricking users into clicking a malicious link, the attacker can exploit the authority of the website to perform unauthorized actions on behalf of the user.
The potential risks of this vulnerability include unauthorized data modification, account hijacking, and spreading malware.
There is no known workaround for this vulnerability. It is crucial to update KindEditor to the latest version to mitigate the CSRF risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for kindeditor.
