CVE-2014-3743 Multiple Content Injection Vulnerabilities in marked
MediumCVSS 6.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm marked(npm) | <= 0.3.0 | No fix listed |
| debian/node-marked(Debian:12) | < 0.3.1+dfsg-1 | 0.3.1+dfsg-1 |
| debian/node-marked(Debian:14) | < 0.3.1+dfsg-1 | 0.3.1+dfsg-1 |
| debian/node-marked(Debian:13) | < 0.3.1+dfsg-1 | 0.3.1+dfsg-1 |
| marked project marked | < 0.3.1 | 0.3.1 |
References
- nvd.nist.gov third-party-advisory
- www.npmjs.com
- github.com
- Debian Security Tracker CVE-2014-3743 vendor-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- nodesecurity.io broken-link