CVE-2024-21535

CVE-2024-21535, security advisory, suse linux, suse, security, cve

CVE-2024-21535

Common Vulnerabilities and Exposures

[Previous] [Index] [Next]

Upstream information

CVE-2024-21535 at MITRE

Description

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v3 Scores

	CNA (report@snyk.io)	National Vulnerability Database	SUSE
Base Score	6.1	6.1	6.1
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector	Network	Network	Network
Attack Complexity	Low	Low	Low
Privileges Required	None	None	None
User Interaction	Required	Required	Required
Scope	Changed	Changed	Changed
Confidentiality Impact	Low	Low	Low
Integrity Impact	Low	Low	Low
Availability Impact	None	None	None
CVSSv3 Version	3.1	3.1	3.1

CVSS v4 Scores

	SUSE
Base Score	5.1
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Attack Vector	Network
Attack Complexity	Low
Attack Requirements	None
Privileges Required	None
User Interaction	Active
Vulnerable System Confidentiality Impact	Low
Vulnerable System Integrity Impact	Low
Vulnerable System Availability Impact	None
Subsequent System Confidentiality Impact	None
Subsequent System Integrity Impact	None
Subsequent System Availability Impact	None
CVSSv4 Version	4.0

SUSE Bugzilla entry: 1231670 [RESOLVED / INVALID]

No SUSE Security Announcements cross referenced.

---

SUSE Timeline for this CVE

CVE page created: Tue Oct 15 08:00:12 2024
CVE page last modified: Wed Oct 23 17:55:07 2024