GHSA-3ww4-cp53-6g2x
Cross Site Request Forgery in kindeditor
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | kindeditor | <= 4.1.12 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.
References
External links from the advisory. They lead to third-party sites.