CVE-2023-41592 - Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability

MEDIUM

Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability

Published Sep 14, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 1.04%

Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.

Ecosystem	Package	Introduced	Fixed
Packagist	froala/wysiwyg-editor	4.0.1	4.1.4
npm	froala-editor	4.0.1	4.1.4

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2529		Advisory
https://froala.com/wysiwyg-editor/changelog/#4.1.4
https://github.com/advisories/GHSA-hvpq-7vcc-5hj5		Advisory
https://github.com/froala/wysiwyg-editor/issues/4612#issuecomment-1729818089
https://hacker.soarescorp.com/cve/2023-41592		ExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-41592
https://owasp.org/Top10/A03_2021-Injection		Third Party Advisory
https://owasp.org/www-project-top-ten		Third Party Advisory