CVE-2020-11055
CVE-2020-11055 · Cross-site Scripting in BookStack
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.
CVSS 6.3 · Moyenne · EPSS 0,8% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
bookstack
- Versions du logiciel
- >= 0.18.0, < 0.29.2: Concernée
Aucun correctif publié
ssddanbrown/bookstack Packagist
- Versions du logiciel
- v0.18.0
- v0.18.1
- v0.18.2
- v0.18.3
- v0.18.4
- v0.18.5
- v0.19.0
- v0.20.0
- v0.20.1
- v0.20.2
- v0.20.3
- v0.21.0
- v0.22.0
- v0.23.0
- v0.23.1
- v0.23.2
- v0.24.0
- v0.24.1
- v0.24.2
- v0.24.3
- v0.25.0
- v0.25.1
- v0.25.2
- v0.25.3
- v0.25.4
- v0.25.5
- v0.26.0
- v0.26.1
- v0.26.2
- v0.26.3
- v0.26.4
- v0.27
- v0.27.1
- v0.27.2
- v0.27.3
- v0.27.4
- v0.27.5
- v0.28.0
- v0.28.1
- v0.28.2
- v0.28.3
- v0.29.0
- v0.29.1
- Plages de versions concernées
- ECOSYSTEM: ≥ 0.18.0, < 0.29.2
Mettez à jour vers 0.29.2