Kurz gesagt
- CVE-2015-1370 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in marked (marked project), marked.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.0%, höher als bei 81.2% aller Schwachstellen.
- Abhilfe: auf 0.3.3 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| marked | ≤ 0.3.2
| No fix yet |
| marked npm | < 0.3.3
| 0.3.3
|
Description
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
Proof of Concept ( IE10 Compatibility Mode Only )
[xss link](vbscript:alert(1))
will get a link
<a href="vbscript:alert(1)">xss link</a>
Recommendation
Update to version 0.3.3 or later.
NVD description
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free