CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://jvn.jp/en/jp/JVN41035278/index.html	Third Party Advisory
https://bookstackapp.com/blog/beta-release-v0-29-2/	Release Notes Vendor Advisory
https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2	Release Notes
https://github.com/BookStackApp/BookStack/security/advisories/GHSA-5vf7-q87h-pg6w	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-05-07 21:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-11055

Mitre link : CVE-2020-11055

CVE.ORG link : CVE-2020-11055

JSON object : View

Products Affected

bookstackapp

bookstack

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2020-11055", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2020-05-07T21:15:11.733", "references": [{"url": "http://jvn.jp/en/jp/JVN41035278/index.html", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://bookstackapp.com/blog/beta-release-v0-29-2/", "tags": ["Release Notes", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/BookStackApp/BookStack/security/advisories/GHSA-5vf7-q87h-pg6w", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2."}, {"lang": "es", "value": "En BookStack versiones posteriores o igual a 0.18.0 y versiones menores a 0.29.2, se presenta una vulnerabilidad de tipo XSS en la creaci\u00f3n de comentarios. Un usuario con permiso para crear comentarios podr\u00eda PUBLICAR HTML directamente en el sistema para ser guardado en un comentario, que luego es ejecutado y desplegado a otros usuarios que visualicen el comentario. Por medio de esta vulnerabilidad, el c\u00f3digo JavaScript personalizado podr\u00eda ser inyectado y, por lo tanto, ejecutarse en otras m\u00e1quinas de usuario. Esto impacta m\u00e1s a los escenarios en los que los usuarios no confiables se le otorgan permiso para crear comentarios. Esto se ha corregido en 0.29.2."}], "lastModified": "2020-05-13T17:30:15.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B988CCC-6913-4C11-8ABD-A4E5660EDFBB", "versionEndExcluding": "0.29.2", "versionStartIncluding": "0.18.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}