CVE-2023-27472
High
Description
quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulnerability). Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag in any entity name. This issue has been patched in version 1.28.1 of the application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityHigh
CVSS8.2
Exploit probability—
ProductQuickentity Editor
PublishedMar 6, 2023
First seenMar 6, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- quickentity_editor_project quickentity_editor1.28.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| quickentity_editor_project quickentity_editor | v < 1.28.1 | 1.28.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.