Description

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.

Remediation

References

https://github.com/TylerGarlick/angular-redactor/issues/77

https://github.com/gleez/cms/issues/796

Related Vulnerabilities

CVE-2020-10693 Vulnerability in maven package org.hibernate.validator:hibernate-validator

CVE-2023-25345 Vulnerability in maven package org.webjars.npm:swig-templates

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.hpprinter

CVE-2022-33980 Vulnerability in maven package org.apache.commons:commons-configuration2

CVE-2018-1000548 Vulnerability in maven package com.umlet:umlet-swing

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory CWE-79