Description

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.

Remediation

References

https://github.com/TylerGarlick/angular-redactor/issues/77

https://github.com/gleez/cms/issues/796

Related Vulnerabilities

CVE-2021-33562 Vulnerability in maven package com.shopizer:shopizer

CVE-2023-0044 Vulnerability in maven package io.quarkus:quarkus-vertx-http

CVE-2023-34602 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

CVE-2023-43500 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2018-3787 Vulnerability in npm package simplehttpserver

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory