6.1
CVE-2020-19952
- EPSS 0.05%
- Veröffentlicht 11.08.2023 14:15:09
- Zuletzt bearbeitet 21.11.2024 05:09:30
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jbt ≫ Live (github-flavored) Markdown Editor Version < 2019-10-27
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.143 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.