icon

We found results for “

CVE-2020-23849

Good to know:

icon
icon

Date: January 11, 2021

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.

Language: JS

Severity Score

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version hillelcoren/invoice-ninja - v3.2.1;hillelcoren/invoice-ninja - v4.5.7;hillelcoren/invoice-ninja - v5.1.73;hillelcoren/invoice-ninja - v2.6.6;hillelcoren/invoice-ninja - v5.3.20;hillelcoren/invoice-ninja - dev-eway;hillelcoren/invoice-ninja - v4.5.45;hillelcoren/invoice-ninja - dev-v5-stable;hillelcoren/invoice-ninja - v5.0.29;hillelcoren/invoice-ninja - v4.4.1;hillelcoren/invoice-ninja - v4.5.32;hillelcoren/invoice-ninja - v3.3.1;hillelcoren/invoice-ninja - v5.0.12;snowsoft/json-editor - v1.0.0;snowsoft/json-editor - no_fix;snowsoft/json-editor - v1.0.9;snowsoft/json-editor - v1.0.7;snowsoft/json-editor - v1.0.2;uskur/configuration-manager - no_fix;uskur/configuration-manager - 1;locomotivemtl/charcoal-admin - dev-feature/delayed-notifications;locomotivemtl/charcoal-admin - 0.24.3;locomotivemtl/charcoal-admin - dev-fix/acl-role-name;locomotivemtl/charcoal-admin - 0.16.3;locomotivemtl/charcoal-admin - 0.17.3.1;locomotivemtl/charcoal-admin - dev-assetic;locomotivemtl/charcoal-admin - dev-master;locomotivemtl/charcoal-admin - dev-feature/advanced-search;locomotivemtl/charcoal-admin - 0.15.10;locomotivemtl/charcoal-admin - 0.17.2.1;locomotivemtl/charcoal-admin - dev-mcaskill-patch-phpunit;locomotivemtl/charcoal-admin - 0.16.1;locomotivemtl/charcoal-admin - dev-joel/fix-asset-builder;locomotivemtl/charcoal-admin - dev-property-condional-logic-parser;locomotivemtl/charcoal-admin - 0.17.0;jxlwqq/json-editor - v1.0.2;jxlwqq/json-editor - no_fix;myzero1/yii2-restbyconf - no_fix;myzero1/yii2-restbyconf - 1.0.0;myzero1/yii2-restbyconf - 2.0.8;ak73gucas/json-editor - no_fix;aloudnoise/aloud-core - no_fix;phuongnamsoft/admin - no_fix;charcoal/admin - dev-joel/property-condional-logic-parser;charcoal/admin - dev-xav/quick-form-lang-tab;charcoal/admin - dev-cdn-cache-purge;charcoal/admin - 0.24.3;asvae-d/laravel-api-tester - 2.0.0-alpha;Ladder - 3.1.0;JSONEditor - no_fix;soda-framework/cms - 0.1.1;soda-framework/cms - 0.0.1;soda-framework/cms - 0.3.1;soda-framework/cms - 0.4.1;soda-framework/cms - 0.5.1;caffeina/aeria - dev-master;caffeina/aeria - dev-feature/group;caffeina/aeria - 1.0.1;caffeina/aeria - dev-dependabot/add-v2-config-file;caffeina/aeria - 1.8.72-pre;sodacms/sodacms - 0.0.1;sodacms/sodacms - 0.1.1;sodacms/sodacms - 0.5.1;sodacms/sodacms - 0.3.1;sodacms/sodacms - 0.4.1;macdabby/jsoneditor - no_fix;ecomteck/module-order-custom-attributes - no_fix;ddpro/admin - no_fix;cmskit/jsoneditor - no_fix;jsoneditor - 9.0.2;asvae/laravel-api-tester - 1.0.4;asvae/laravel-api-tester - 2.0.0-alpha;delatbabel/admin - no_fix;myzero1/yii2-apibyconf - no_fix;arx/arxmin - 5.2.0;pmurkin/bootstrapi - no_fix;craftisan/laravel-api-tester - 2.0.0-alpha;lightningsdk/core - no_fix;aheinze/cockpit - 0.9.1;aheinze/cockpit - 0.7.3;xdd/x-template - no_fix;lukaschel/pimcore-bundle-configuration - no_fix;org.webjars.npm:jsoneditor:9.5.3;org.webjars.npm:github-com-josdejong-jsoneditor:9.1.1;org.webjars.bowergithub.josdejong:jsoneditor:5.28.2;org.webjars.bower:jsoneditor:5.9.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us