CVE-2024-38354

Summary

CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.

Affected Software

Weaknesses

• CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• https://github.com/hackmdio/codimd/security/advisories/GHSA-22jv-vch8-2vp9

References

• https://github.com/hackmdio/codimd/security/advisories/GHSA-22jv-vch8-2vp9

• ←Previous
• Next→