CVE-2014-3743
MEDIUMmarked < 0.3.1 - Cross-Site Scripting via GFM Codeblocks or JavaScript URLs
Title source: llmDescription
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
References (4)
Core 4
Core References
Broken Link x_refsource_misc
https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2014/05/13/1
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2014/05/15/2
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3743
Scores
CVSS v3
6.1
EPSS
0.0171
EPSS Percentile
75.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
marked_project/marked
< 0.3.1
npm/marked
0 - 0.3.1npm
Published
Jan 06, 2020
Tracked Since
Feb 18, 2026