CVE-2017-11594

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2017-11594

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-11594.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2017-11594

Published

2017-07-24T01:29:00.740Z

Modified

2025-11-14T05:00:15.286404Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment.

References

Affected packages

Git / github.com/loomio/loomio

Affected ranges

Type: GIT
Repo: https://github.com/loomio/loomio
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

5b51067e58606bc6b4dae8018a3a26172d7949ef

Fixed

63973f71e337ead8ca7b7ae2a043b837032dc3fe

Affected versions

0.*

0.16.0

0.17.0

0.18.0

0.19.0

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

v0.*

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.15.0

v0.9.0

v1.*

v1.7.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-11594.json"