Skip to content

XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

Moderate severity GitHub Reviewed Published Nov 25, 2021 in ezsystems/ezplatform-richtext • Updated Apr 3, 2023

Package

composer ezsystems/ezplatform-richtext (Composer)

Affected versions

>= 2.3.0, < 2.3.7.1

Patched versions

2.3.7.1

Description

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.

References

@glye glye published to ezsystems/ezplatform-richtext Nov 25, 2021
Reviewed Nov 29, 2021
Published to the GitHub Advisory Database Dec 1, 2021
Last updated Apr 3, 2023

Severity

Moderate

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-fxwm-rx68-p5vx

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.