In breve
- CVE-2015-1370 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda marked (marked project), marked.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.0%, superiore al 81.2% delle vulnerabilità.
- Correzione: aggiornare a 0.3.3 o successiva.
| Package | Affected versions | Patched versions |
|---|
| marked | ≤ 0.3.2
| No fix yet |
| marked npm | < 0.3.3
| 0.3.3
|
Description
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
Proof of Concept ( IE10 Compatibility Mode Only )
[xss link](vbscript:alert(1))
will get a link
<a href="vbscript:alert(1)">xss link</a>
Recommendation
Update to version 0.3.3 or later.
NVD description
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free