Upstream information

CVE-2024-21535 at MITRE

Description

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v3 Scores
  CNA (report@snyk.io) National Vulnerability Database SUSE
Base Score 6.1 6.1 6.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network Network Network
Attack Complexity Low Low Low
Privileges Required None None None
User Interaction Required Required Required
Scope Changed Changed Changed
Confidentiality Impact Low Low Low
Integrity Impact Low Low Low
Availability Impact None None None
CVSSv3 Version 3.1 3.1 3.1
CVSS v4 Scores
  SUSE
Base Score 5.1
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User Interaction Active
Vulnerable System Confidentiality Impact Low
Vulnerable System Integrity Impact Low
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1231670 [RESOLVED / INVALID]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Tue Oct 15 08:00:12 2024
CVE page last modified: Thu Oct 31 13:52:40 2024