GitHub Advisoryadvisory · Packagist

GHSA-5rcc-6cmj-7728 Cross-site Scripting in BookStack

MEDIUM Published 2022-03-09 Modified 2022-03-14 Official page ↗
Aliases
CVE-2022-0877
Ecosystem
Packagist
Packages
ssddanbrown/bookstack
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-03-09

Affected packages

• Packagist ssddanbrown/bookstack: < 22.02.3 → fixed in 22.02.3

Description

Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.

Related

Alias · CVE (1)

  • CVE-2022-0877 Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References