Vulnerability-Lookup

CNVD-2021-93909

Vulnerability from cnvd - Published: 2021-12-03

Title

HedgeDoc跨站脚本漏洞（CNVD-2021-93909）

Description

HedgeDoc是一个编写和分享Markdown的平台。 HedgeDoc 1.9.0之前版本存在跨站脚本漏洞。攻击者可通过将托管恶意代码的iframe嵌入幻灯片或将HedgeDoc实例嵌入另一个页面利用该漏洞将任意JavaScript注入幻灯片模式功能的演讲者备注中。

Severity

中

Patch Name

HedgeDoc跨站脚本漏洞（CNVD-2021-93909）的补丁

Patch Description

HedgeDoc是一个编写和分享Markdown的平台。 HedgeDoc 1.9.0之前版本存在跨站脚本漏洞。攻击者可通过将托管恶意代码的iframe嵌入幻灯片或将HedgeDoc实例嵌入另一个页面利用该漏洞将任意JavaScript注入幻灯片模式功能的演讲者备注中。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-39175

Impacted products

Name
Hedgedoc HedgeDoc <1.9.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-39175",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-39175"
    }
  },
  "description": "HedgeDoc\u662f\u4e00\u4e2a\u7f16\u5199\u548c\u5206\u4eabMarkdown\u7684\u5e73\u53f0\u3002\n\nHedgeDoc 1.9.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5c06\u6258\u7ba1\u6076\u610f\u4ee3\u7801\u7684iframe\u5d4c\u5165\u5e7b\u706f\u7247\u6216\u5c06HedgeDoc\u5b9e\u4f8b\u5d4c\u5165\u53e6\u4e00\u4e2a\u9875\u9762\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u4efb\u610fJavaScript\u6ce8\u5165\u5e7b\u706f\u7247\u6a21\u5f0f\u529f\u80fd\u7684\u6f14\u8bb2\u8005\u5907\u6ce8\u4e2d\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-93909",
  "openTime": "2021-12-03",
  "patchDescription": "HedgeDoc\u662f\u4e00\u4e2a\u7f16\u5199\u548c\u5206\u4eabMarkdown\u7684\u5e73\u53f0\u3002\r\n\r\nHedgeDoc 1.9.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5c06\u6258\u7ba1\u6076\u610f\u4ee3\u7801\u7684iframe\u5d4c\u5165\u5e7b\u706f\u7247\u6216\u5c06HedgeDoc\u5b9e\u4f8b\u5d4c\u5165\u53e6\u4e00\u4e2a\u9875\u9762\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u4efb\u610fJavaScript\u6ce8\u5165\u5e7b\u706f\u7247\u6a21\u5f0f\u529f\u80fd\u7684\u6f14\u8bb2\u8005\u5907\u6ce8\u4e2d\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "HedgeDoc\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2021-93909\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Hedgedoc HedgeDoc \u003c1.9.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-39175",
  "serverity": "\u4e2d",
  "submitTime": "2021-08-31",
  "title": "HedgeDoc\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2021-93909\uff09"
}

CVE-2021-39175 (GCVE-0-2021-39175)

Vulnerability from cvelistv5 – Published: 2021-08-30 20:40 – Updated: 2024-08-04 01:58

Title

XSS vector in slide mode speaker-view

Summary

HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/hedgedoc/hedgedoc/security/adv…	x_refsource_CONFIRM
https://github.com/hedgedoc/hedgedoc/pull/1369	x_refsource_MISC
https://github.com/hedgedoc/hedgedoc/pull/1375	x_refsource_MISC
https://github.com/hedgedoc/hedgedoc/pull/1513	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
hedgedoc	hedgedoc	Affected: < 1.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:58:18.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hedgedoc/hedgedoc/pull/1369"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hedgedoc/hedgedoc/pull/1375"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hedgedoc/hedgedoc/pull/1513"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hedgedoc",
          "vendor": "hedgedoc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-30T20:40:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hedgedoc/hedgedoc/pull/1369"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hedgedoc/hedgedoc/pull/1375"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hedgedoc/hedgedoc/pull/1513"
        }
      ],
      "source": {
        "advisory": "GHSA-j748-779h-9697",
        "discovery": "UNKNOWN"
      },
      "title": "XSS vector in slide mode speaker-view",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39175",
          "STATE": "PUBLIC",
          "TITLE": "XSS vector in slide mode speaker-view"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "hedgedoc",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.9.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "hedgedoc"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346: Origin Validation Error"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697",
              "refsource": "CONFIRM",
              "url": "https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697"
            },
            {
              "name": "https://github.com/hedgedoc/hedgedoc/pull/1369",
              "refsource": "MISC",
              "url": "https://github.com/hedgedoc/hedgedoc/pull/1369"
            },
            {
              "name": "https://github.com/hedgedoc/hedgedoc/pull/1375",
              "refsource": "MISC",
              "url": "https://github.com/hedgedoc/hedgedoc/pull/1375"
            },
            {
              "name": "https://github.com/hedgedoc/hedgedoc/pull/1513",
              "refsource": "MISC",
              "url": "https://github.com/hedgedoc/hedgedoc/pull/1513"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-j748-779h-9697",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-39175",
    "datePublished": "2021-08-30T20:40:13.000Z",
    "dateReserved": "2021-08-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T01:58:18.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted