wangeditor-team/wangeditor · Security
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function
- GHSA ID
- GHSA-9hfw-cvf4-5x25
- CVE ID
- CVE-2022-25037
- Severity
- medium
- Published
- Updated
- CVSS
- 5.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 5.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25037 ↗
- https://github.com/wangeditor-team/wangEditor/issues/3870 ↗
- https://gist.github.com/Mdxjj/5cf0a31e8abf24ed688ceb5b3543516d ↗
- https://github.com/wangeditor-team/wangEditor/issues/3872 ↗
- https://github.com/wangeditor-team/wangEditor/commit/6257a2e166346913c34ac5cfb31b6a46e9544c5a ↗
- https://github.com/advisories/GHSA-9hfw-cvf4-5x25 ↗