CVE-2022-23461

low-risk
Published 2022-09-24

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Jodit Editor

Affected Vendors

Xdsoft

References (2)

Exploit https://securitylab.github.com/advisories/GHSL-2022-030_xdan_jodit/
Exploit https://securitylab.github.com/advisories/GHSL-2022-030_xdan_jodit/
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal