CVE-2018-20583 PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
MediumCVSS 6.1
EPSS 1.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| league/commonmark(Packagist) | >= 0.15.6, < 0.18.1 | 0.18.1 |
| league/commonmark(Packagist) | = 0.15.6 | No fix listed |
| league/commonmark(Packagist) | = 0.15.7 | No fix listed |
| league/commonmark(Packagist) | = 0.16.0 | No fix listed |
| league/commonmark(Packagist) | = 0.17.0 | No fix listed |
| league/commonmark(Packagist) | = 0.17.1 | No fix listed |
| league/commonmark(Packagist) | = 0.17.2 | No fix listed |
| league/commonmark(Packagist) | = 0.17.3 | No fix listed |
| league/commonmark(Packagist) | = 0.17.4 | No fix listed |
| league/commonmark(Packagist) | = 0.17.5 | No fix listed |
| league/commonmark(Packagist) | = 0.18.0 | No fix listed |
| thephpleague commonmark | >= 0.15.6, <= 0.18.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- commonmark.thephpleague.com release-notes third-party-advisory
- github.com exploit
- github.com product
- github.com release-notes third-party-advisory
- github.com
- Debian Security Tracker CVE-2018-20583 vendor-advisory