XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Moderate severity
GitHub Reviewed
Published
Nov 25, 2021
in
ezsystems/ezplatform-richtext
•
Updated Apr 3, 2023
Package
Affected versions
>= 2.3.0, < 2.3.7.1
Patched versions
2.3.7.1
Description
Reviewed
Nov 29, 2021
Published to the GitHub Advisory Database
Dec 1, 2021
Last updated
Apr 3, 2023
Credits
-
tdunlap607 Analyst
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
References