GitHub Advisoryadvisory · npm

GHSA-3ww4-cp53-6g2x Cross Site Request Forgery in kindeditor

HIGH Published 2021-10-18 Modified 2021-10-21 Official page ↗
Aliases
CVE-2021-42228
Ecosystem
npm
Packages
kindeditor
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2021-10-15

Affected packages

• npm kindeditor: <= 4.1.12 (no fix yet)

Description

Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.

Related

Alias · CVE (1)

  • CVE-2021-42228 A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References