CVE-2023-3026
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository jgraph/drawio prior to version 21.2.8, allowing for the storage of malicious code.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 21.2.8 or later to mitigate this vulnerability.
Other vulnerabilities in jgraph/drawio
See all- CVE-2023-3975Critical
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.5.0.
- CVE-2023-3974Critical
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.4.0.
- CVE-2023-3973Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.
- CVE-2023-3398High
Denial of Service vulnerability exists in the GitHub repository jgraph/drawio prior to version 18.1.3.
Original NVD description (English source)
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS