CVE-2019-13127
MEDIUM 6.1EPSS 1.5%
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
- CVSS v3.0 NVD
- 6.1 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 1.50% chance of exploitation in the next 30 days, 74th percentile
- Published
- 2019-07-01
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-032.txt
- ossf-cve-benchmark/CVE-2019-131270★ · 2020-12-01
Security advisories
- jgraph/mxgraph/commit/76e8e2809b622659a9c5ffdc4f19922b7a68cfa3
- https://marketplace.atlassian.com/apps/1210933/draw-io-diagrams-for-confluence/version-hi…
- advisories/GHSA-xm59-jvxm-cp3v