PT-2018-15450

CVE-2018-20583

Publicado

2018-12-30

Atualizado

2022-05-14

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP League CommonMark library versions 0.15.6 through 0.18.x

Description The issue allows remote attackers to insert unsafe URLs into HTML, even when allow unsafe links is set to false, by utilizing a newline character. This can be achieved by writing javascript as javsacri%0apt, demonstrating the potential for malicious script injection.

Recommendations For PHP League CommonMark library versions 0.15.6 through 0.18.x, update to version 0.18.1 or later to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados

CVE-2018-20583