p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @backstage/plugin-techdocs-backend

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @backstage/plugin-techdocs-backend: 2. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 4

  1. CVE-2026-106490

    Mittel · CVSS 6.5EPSS 0,37%Korrektur verfügbar

    Backstage: Improper input validation in TechDocs static content requests

    Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4.

    @backstage/plugin-techdocs-backendNode.js
    • Auf 2.2.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-106489

    Mittel · CVSS 6.5EPSS 0,29%Korrektur verfügbar

    Backstage: Improper authorization enforcement for TechDocs static content

    Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This

    @backstage/plugin-techdocs-backendNode.js
    • Auf 2.2.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2024-45816

    Mittel · CVSS 6.5EPSS 0,73%Korrektur verfügbar

    Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

    Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    @backstage/plugin-techdocs-backendNode.js
    • Auf 1.10.13 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2024-46976

    Mittel · CVSS 6.5EPSS 0,29%Korrektur verfügbar

    Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend

    Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability.

    @backstage/plugin-techdocs-backendNode.js
    • Auf 1.10.13 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →