The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy (CSP).
References
Link | Resource |
---|---|
https://vul.su.ki/posts/Chat_Anywhere_2.4.0_XSS.md/ | Exploit Third Party Advisory |
History
No history.
![cve-icon](/static/img/cve-icon.png)
Status: PUBLISHED
Assigner: mitre
Published: 2022-10-03T16:22:06
Updated: 2022-10-03T16:22:06
Reserved: 2022-10-03T00:00:00
Link: CVE-2018-20524
JSON object: View
![cve-icon](/static/img/nvd-icon.png)
Status : Analyzed
Published: 2018-12-27T18:29:00.217
Modified: 2019-01-17T16:46:45.877
Link: CVE-2018-20524
JSON object: View
![cve-icon](/static/img/redhat-icon.png)
No data.
CWE