Description

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.

Remediation

References

https://github.com/gleez/cms/issues/796

https://github.com/TylerGarlick/angular-redactor/issues/77

Related Vulnerabilities

CVE-2023-34602 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

CVE-2020-2124 Vulnerability in maven package com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

CVE-2021-32820 Vulnerability in npm package express-handlebars

CVE-2018-3735 Vulnerability in npm package bracket-template

CVE-2022-36917 Vulnerability in maven package org.jenkins-ci.plugins:google-cloud-backup

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory