GitHub Advisoryadvisory · npm

GHSA-5j94-f3mf-8685 @backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

MEDIUM Published 2024-09-17 Modified 2024-09-17 Official page ↗
Aliases
CVE-2024-46976
Ecosystem
npm
Packages
@backstage/plugin-techdocs-backend
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-693, CWE-79
Reviewed
2024-09-17

Affected packages

• npm @backstage/plugin-techdocs-backend: < 1.10.13 → fixed in 1.10.13

Description

Impact An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. Patches This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. References If you have any questions or comments about this advisory: Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

Related

Alias · CVE (1)

  • CVE-2024-46976 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-693 Protection Mechanism Failure weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References