En bref
- CVE-2015-1370 est une vulnérabilité MOYENNE (CVSS 4.3) touchant marked (marked project), marked.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.0%, plus élevée que 81.2% des vulnérabilités.
- Correctif : mettre à jour vers 0.3.3 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| marked | ≤ 0.3.2
| No fix yet |
| marked npm | < 0.3.3
| 0.3.3
|
Description
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
Proof of Concept ( IE10 Compatibility Mode Only )
[xss link](vbscript:alert(1))
will get a link
<a href="vbscript:alert(1)">xss link</a>
Recommendation
Update to version 0.3.3 or later.
NVD description
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free