GitHub Advisoryadvisory · Packagist

GHSA-rphc-h572-2x9f Cross-site Scripting in showdoc/showdoc

CRITICAL Published 2022-03-15 Modified 2022-03-24 Official page ↗
Aliases
CVE-2022-0960
Ecosystem
Packagist
Packages
showdoc/showdoc
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-434, CWE-79
Reviewed
2022-03-15

Affected packages

• Packagist showdoc/showdoc: < 2.10.4 → fixed in 2.10.4

Description

ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.

Related

Alias · CVE (1)

  • CVE-2022-0960 Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4. vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References