CVE-2020-15138highCWE-79

CVE-2020-15138: fallo de gravedad alta en PrismJS prism

Cross-Site Scripting in Prism

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear prismjs+ Monitorear prismjs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 2.0%
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Productos afectados
PrismJS · prism
CVEs relacionadas — PrismJS prism

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-23647HIGHCross-site Scripting in PrismEPSS 1.4%CVE-2021-32723HIGHRegular Expression Denial of Service (ReDoS) in PrismEPSS 1.4%