CVE-2020-11055
CVE-2020-11055 · Cross-site Scripting in BookStack
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.
CVSS 6.3 · Media · EPSS 0,8% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
bookstack
- Versiones
- >= 0.18.0, < 0.29.2: Afectada
Sin corrección publicada
ssddanbrown/bookstack Packagist
- Versiones
- v0.18.0
- v0.18.1
- v0.18.2
- v0.18.3
- v0.18.4
- v0.18.5
- v0.19.0
- v0.20.0
- v0.20.1
- v0.20.2
- v0.20.3
- v0.21.0
- v0.22.0
- v0.23.0
- v0.23.1
- v0.23.2
- v0.24.0
- v0.24.1
- v0.24.2
- v0.24.3
- v0.25.0
- v0.25.1
- v0.25.2
- v0.25.3
- v0.25.4
- v0.25.5
- v0.26.0
- v0.26.1
- v0.26.2
- v0.26.3
- v0.26.4
- v0.27
- v0.27.1
- v0.27.2
- v0.27.3
- v0.27.4
- v0.27.5
- v0.28.0
- v0.28.1
- v0.28.2
- v0.28.3
- v0.29.0
- v0.29.1
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 0.18.0, < 0.29.2
Actualiza a 0.29.2