MEDIUM
GHSA-fxwm-rx68-p5vx
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Quick fix
GHSA-fxwm-rx68-p5vx — ezsystems/ezplatform-richtext: upgrade to the fixed version with the command below.
composer require ezsystems/ezplatform-richtext:^2.3.7.1Details
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/ezsystems/ezplatform-richtext
Introduced in:
2.3.0Fixed in: 2.3.7.1Fix
composer require ezsystems/ezplatform-richtext:^2.3.7.1References
- https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-fxwm-rx68-p5vx[WEB]
- https://github.com/ezsystems/ezplatform-richtext/commit/3cebfe2ae4c22e6590632a0ff71893854a16afc5[WEB]
- https://developers.ibexa.co/security-advisories/ibexa-sa-2021-010-xss-in-richtext-custom-tag-attributes[WEB]
- https://github.com/ezsystems/ezplatform-richtext[PACKAGE]