Description
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| maalfer | Pentestify | < 2.3.2 | 2.3.2 |