high8.8
CVE-2021-42228
Cross Site Request Forgery in kindeditor
Impact
Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | kindeditor | <= 4.1.12 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kindsoft | Kindeditor | from 4.1 through 4.1.12 |