Back to CVE Browser

CVE-2021-39175

HIGH

8.1

CVSS Severity Score

EPSS Score0.0840%

EPSS Percentile27.74th

PublishedAug 30, 2021

Last ModifiedNov 21, 2024

Vulnerability Description

HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading.

Affected Platforms (CPE)

📦

Hedgedoc

Hedgedoc

< 1.9.0

References & Advisories

🔗 https://github.com/hedgedoc/hedgedoc/pull/1369

🔗 https://github.com/hedgedoc/hedgedoc/pull/1375

🔗 https://github.com/hedgedoc/hedgedoc/pull/1513

🔗 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697

🔗 https://github.com/hedgedoc/hedgedoc/pull/1369

🔗 https://github.com/hedgedoc/hedgedoc/pull/1375

🔗 https://github.com/hedgedoc/hedgedoc/pull/1513

🔗 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697

Related Vulnerabilities

CVE-2021-2947510.0

HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary file...

CVE-2020-262878.7

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arb...

CVE-2021-295038.1

HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack u...

CVE-2020-262867.5

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacke...