Medium severity · published May 1, 2023
CVE-2023-29641
Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Editor.md · Ipandao
through 1.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29641
Exploit
https://github.com/pandao/editor.md/issues/985
More from Editor.md
6.1
CVE-2020-19660
Cross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values
6.1
CVE-2020-19698
Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter
6.1
CVE-2020-19697
Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the <iframe>src parameter
6.1
CVE-2019-14653
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element
6.1
CVE-2019-9737
Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring