En resumen
- CVE-2015-1370 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a marked (marked project), marked.
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 81.2% de las vulnerabilidades.
- Solución: actualizar a 0.3.3 o posterior.
| Package | Affected versions | Patched versions |
|---|
| marked | ≤ 0.3.2
| No fix yet |
| marked npm | < 0.3.3
| 0.3.3
|
Description
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
Proof of Concept ( IE10 Compatibility Mode Only )
[xss link](vbscript:alert(1))
will get a link
<a href="vbscript:alert(1)">xss link</a>
Recommendation
Update to version 0.3.3 or later.
NVD description
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free