Description

Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.

Remediation

References

https://hackerone.com/reports/691977

Related Vulnerabilities

CVE-2020-8124 Vulnerability in maven package org.webjars.npm:url-parse

CVE-2022-31147 Vulnerability in maven package org.webjars.npm:jquery-validation

CVE-2017-3202 Vulnerability in maven package com.exadel.flamingo.flex:amf-serializer

CVE-2022-31159 Vulnerability in maven package com.amazonaws:aws-java-sdk-s3

CVE-2020-7725 Vulnerability in npm package worksmith

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory