SecuriTricks - CVE-2024-34341

Description

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.

Product(s) Impacted

Product	Versions
Trix editor	before 2.1.1

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad

https://github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554

https://github.com/basecamp/trix/pull/1147

https://github.com/basecamp/trix/pull/1149

https://github.com/basecamp/trix/releases/tag/v2.1.1

https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99

CVSS Score

5.4 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

View Vector String

Timeline

Published: May 7, 2024, 4:15 p.m.
Last Modified: May 7, 2024, 8:07 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVE-2024-34341