Description

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.

Remediation

References

CVE-2018-1999024

Related Vulnerabilities

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2018-1302)

WordPress Plugin Smooth Scroll Page Up/Down Buttons Cross-Site Scripting (1.3)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2018-1318)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Open Redirect (3.7.2.3)

WordPress Plugin Coming Soon & Maintenance Mode Page Cross-Site Request Forgery (1.57)

Severity

Medium

Classification

CVE-2018-1999024 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities