Is CVE-2023-41592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-41592 being exploited in the wild.

How severe is CVE-2023-41592?

Low severity, with a CVSS score of 3.1, published 15 September 2023.

Which products and versions are affected?

Froala Editor 4.0.1 to 4.1.3; froala-editor (npm) SEMVER:introduced=4.0.1,fixed=4.1.4; froala/wysiwyg-editor (Packagist) ECOSYSTEM:introduced=4.0.1,fixed=4.1.4.

Is there a fix for CVE-2023-41592?

Yes. froala-editor (npm): upgrade to 4.1.4 or later; froala/wysiwyg-editor (Packagist): upgrade to 4.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-41592 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-41592?

Check whether you run Froala Editor, froala-editor (npm) or froala/wysiwyg-editor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-41592: Froala Editor cross-site scripting vulnerability

CVE-2023-41592 · Severity: low · CVSS 3.1 · Published 2023-09-15

Froala Editor is a rich-text document editor used in web applications to allow users to create and format content. Versions 4.0.1 through 4.1.3 contain a cross-site scripting (XSS) vulnerability that allows attackers with editor access to inject malicious scripts that execute in other users' browsers, potentially compromising account credentials, stealing session tokens, or defacing content.

Technologies: Froala Editor, froala-editor (npm), froala/wysiwyg-editor (Packagist). Vendors: Froala, npm, Packagist.

Quick answers

Is CVE-2023-41592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-41592 being exploited in the wild.
How severe is CVE-2023-41592?: Low severity, with a CVSS score of 3.1, published 15 September 2023.
Which products and versions are affected?: Froala Editor 4.0.1 to 4.1.3; froala-editor (npm) SEMVER:introduced=4.0.1,fixed=4.1.4; froala/wysiwyg-editor (Packagist) ECOSYSTEM:introduced=4.0.1,fixed=4.1.4.
Is there a fix for CVE-2023-41592?: Yes. froala-editor (npm): upgrade to 4.1.4 or later; froala/wysiwyg-editor (Packagist): upgrade to 4.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-41592 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-41592?: Check whether you run Froala Editor, froala-editor (npm) or froala/wysiwyg-editor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

froala-editor (npm): upgrade to 4.1.4 or later
```
npm install froala-editor@4.1.4
```
froala/wysiwyg-editor (Packagist): upgrade to 4.1.4 or later
```
composer require froala/wysiwyg-editor:^4.1.4
```

Technical details

This is a stored cross-site scripting (XSS) vulnerability in Froala Editor versions 4.0.1 to 4.1.3, classified as CWE-79. The vulnerability allows an authenticated or privileged user to inject malicious JavaScript through the editor interface that persists when the content is viewed by other users. Attack requires user interaction (opening the edited content) and authentication to use the editor, but impact spans across sessions (C:L, I:L per CVSS 3.1). The vulnerability was patched in version 4.1.4.

Affected products

Froala Editor 4.0.1 to 4.1.3

Identifiers

CVE-2023-41592
GHSA-hvpq-7vcc-5hj5

Timeline

2023-09-14: disclosed: CVE-2023-41592 published
2023: patched: Fixed in version 4.1.4

References

https://github.com/froala/wysiwyg-editor/issues/4612

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.