GitHub Advisoryadvisory · Packagist
GHSA-fxwm-rx68-p5vx XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- ezsystems/ezplatform-richtext
- Severity
- Moderate
- Weaknesses
- CWE-79
- Reviewed
- 2021-11-29
Affected packages
• Packagist ezsystems/ezplatform-richtext: >= 2.3.0, < 2.3.7.1 → fixed in 2.3.7.1
Description
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-fxwm-rx68-p5vx web
- https://github.com/ezsystems/ezplatform-richtext/commit/3cebfe2ae4c22e6590632a0ff71893854a16afc5 web
- https://developers.ibexa.co/security-advisories/ibexa-sa-2021-010-xss-in-richtext-custom-tag-attributes web
- https://github.com/ezsystems/ezplatform-richtext package