Froala Editor Cross-site Scripting vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-41592 · ADVISORY
• froala/wysiwyg-editor · WEB
• froala.com/wysiwyg-editor/changelog · WEB
• froala/wysiwyg-editor · PACKAGE
• hacker.soarescorp.com/cve/2023-41592 · WEB
• owasp.org/Top10/A03_2021-Injection · WEB
• owasp.org/www-project-top-ten · WEB
• hacker.soarescorp.com/cve/2023-41592 · Exploit
• owasp.org/Top10/A03_2021-Injection · Third Party Advisory
• owasp.org/www-project-top-ten · Third Party Advisory

froala/wysiwyg-editor のその他の脆弱性

• CVE-2024-51434中 6.1Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.
• CVE-2021-28114中 5.4Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
• CVE-2020-26523中 6.1Froala Editor before 3.2.2 allows XSS via pasted content.