org.webjars.bowergithub.kindsoft:kindeditor 4.1.12 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.bowergithub.kindsoft:kindeditor package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization passed into the `content1` parameter in `demo.jsp`. How to fix Cross-site Scripting (XSS)? There is no fixed version for `org.webjars.bowergithub.kindsoft:kindeditor`.	[0,)
M Cross-site Request Forgery (CSRF) Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via a malicious HTML file being uploaded to a website that uses google editor. Note: This requires a victim to click on the generated malicious link. How to fix Cross-site Request Forgery (CSRF)? There is no fixed version for `org.webjars.bowergithub.kindsoft:kindeditor`.	[0,)
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via a Google search of `inurl:/examples/uploadbutton.html` and then uploading a crafted `.html` file on the website that uses this editor (the file suffix is allowed). How to fix Cross-site Scripting (XSS)? There is no fixed version for `org.webjars.bowergithub.kindsoft:kindeditor`.	[0,)
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an unknown attack vector, affecting the Chinese versions of KindEditor. This can be exploited by an attacker to obtain user cookie information. How to fix Cross-site Scripting (XSS)? There is no fixed version for `org.webjars.bowergithub.kindsoft:kindeditor`.	[0,)
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an unknown attack vector. This can be exploited by an attacker to obtain user cookie information. How to fix Cross-site Scripting (XSS)? There is no fixed version for `org.webjars.bowergithub.kindsoft:kindeditor`.	[0,)
H Directory Traversal kindeditor is a lightweight, Open Source(LGPL), cross browser, web based WYSIWYG HTML editor. Affected versions of this package are vulnerable to Directory Traversal Attacks. A malicious user can browse a file or directory in the `kindeditor/attached/` folder via the path parameter without authentication. How to fix Directory Traversal? There is no fix version for `kindeditor`.	[0,)

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization passed into the content1 parameter in demo.jsp.

How to fix Cross-site Scripting (XSS)?