CVE-2019-19619: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 18, 2021

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.

References

github.com/advisories/GHSA-wmwp-pggc-h4mj
github.com/documize/community/commit/a4384210d4d0d6b18e6fdb7e155de96d4a1cf9f3
github.com/documize/community/compare/v3.5.0...v3.5.1
github.com/documize/community/releases/tag/v3.5.1
nvd.nist.gov/vuln/detail/CVE-2019-19619

Code Behaviors & Features

Detect and mitigate CVE-2019-19619 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →