GitHub Advisoryadvisory · npm
GHSA-h236-g5gh-vq6c DOM-based cross-site scripting in Froala Editor
MEDIUM
Official page ↗
- Aliases
- CVE-2019-19935
- Ecosystem
- npm
- Packages
- froala-editor
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2021-05-11
Affected packages
• npm froala-editor: < 3.2.3 → fixed in 3.2.3
Description
Froala WYSIWYG HTML Editor is a lightweight WYSIWYG HTML Editor written in JavaScript that enables rich text editing capabilities for web applications. A DOM-based cross-site scripting (XSS) vulnerability exists in versions before 3.2.3 because HTML code in the editor is not correctly sanitized when inserted into the DOM. This allows an attacker that can control the editor content to execute arbitrary JavaScript in the context of the victim’s session.
Related
Alias · CVE (1)
- CVE-2019-19935 Froala Editor before 3.2.3 allows XSS. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-19935 advisory
- https://blog.compass-security.com/2020/07/yet-another-froala-0-day-xss web
- https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2020-004_DOM_XSS_in_Froala_WYSIWYG_HTML_Editor.txt web
- https://froala.com/wysiwyg-editor/changelog/#3.2.3 web
- https://github.com/froala/wysiwyg-editor-release package
- https://github.com/froala/wysiwyg-editor/compare/v3.0.5...v3.0.6 web
- https://snyk.io/vuln/npm:froala-editor web
- http://packetstormsecurity.com/files/158300/Froala-WYSIWYG-HTML-Editor-3.1.1-Cross-Site-Scripting.html web