Quick answers
- Is CVE-2024-34449 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-34449 being exploited in the wild.
- How severe is CVE-2024-34449?
- Informational severity, published 3 May 2024.
- Which products and versions are affected?
- Vanessa219 Vditor 3.10.3 and earlier.
- Is there a fix for CVE-2024-34449?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-34449 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-34449?
- Check whether you run vditor (npm). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Vditor 3.10.3 contains a Cross-site Scripting (CWE-79) vulnerability in the preview functionality where user-supplied content within HTML anchor element attributes is not adequately sanitized before rendering. An attacker can inject malicious scripts via attributes of an `A` element in Markdown input that will execute in the victim's browser context. The vulnerability affects the default configuration; however, the vendor notes that enabling the `sanitize=true` option can mitigate the issue. No information regarding patch availability or the affected version range beyond 3.10.3 is currently documented.
Affected products
- Vanessa219 Vditor 3.10.3 and earlier
Identifiers
- CVE-2024-34449
- GHSA-m5jf-8crm-r65m
Timeline
- 2024-05-03: disclosed