CVE-2023-42426

Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://froala.com	Product
https://github.com/b0marek/CVE-2023-42426	Exploit
https://www.youtube.com/watch?v=Me33Dx1_XqQ	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:froala:froala_editor:4.1.1:*:*:*:*:*:*:*

History

25 Sep 2024, 01:36

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-25 21:15

Updated : 2024-09-25 01:36

NVD link : CVE-2023-42426

Mitre link : CVE-2023-42426

CVE.ORG link : CVE-2023-42426

JSON object : View

Products Affected

froala

froala_editor

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-42426", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2023-09-25T21:15:15.640", "references": [{"url": "http://froala.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/b0marek/CVE-2023-42426", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.youtube.com/watch?v=Me33Dx1_XqQ", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting (XSS) en Froala Froala Editor v.4.1.1 permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s del par\u00e1metro 'Insertar enlace' en el componente 'Insertar imagen'."}], "lastModified": "2024-09-25T01:36:09.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:froala:froala_editor:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BB68CF8-9500-4619-B1CF-32FE03ED6B61"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}