CVE-2024-36676
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
- Auf 24.05.1 aktualisieren
Veröffentlicht Aktualisiert
PatchFirst · Aktuelle Sicherheitslücken
Sicherheitslücken in ssddanbrown/bookstack
In den letzten 30 Tagen veröffentlichte Sicherheitslücken für ssddanbrown/bookstack: 0. Davon im KEV-Katalog: 0.
Sicherheitslücken: 10
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
- Auf 22.02.3 aktualisieren
Veröffentlicht AktualisiertImproper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
- Auf 21.12.1 aktualisieren
Veröffentlicht AktualisiertImproper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
- Auf 21.11.3 aktualisieren
Veröffentlicht AktualisiertCross-Site Request Forgery (CSRF) in bookstackapp/bookstack
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
- Auf 21.11 aktualisieren
Veröffentlicht AktualisiertImproper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
- Auf 21.11.2 aktualisieren
Veröffentlicht AktualisiertUnrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
- Auf 21.0.3 aktualisieren
Veröffentlicht AktualisiertCross-Site Scripting in BookStack
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without up
- Auf 0.30.4 aktualisieren
Veröffentlicht AktualisiertCross-site Scripting in BookStack
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.
- Auf 0.29.2 aktualisieren
Veröffentlicht AktualisiertRemote Code Execution Through Image Uploads in BookStack
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Auf 0.25.5 aktualisieren
Veröffentlicht Aktualisiert
Prüfen Sie Ihren Server
Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.