CVE-2020-4052 - Stored XSS through template injection in Wiki.js

Back Back to CVE browser

MEDIUM

Stored XSS through template injection in Wiki.js

Published Jun 16, 2020

6.3

MEDIUM

CVSS 3.1

EPSS 0.83%

Description

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.

Affected products

Vendor Requarks.io Product Wiki.js Default
n/a
- Version
  < 2.4.107
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Requarks.io

Wiki.js

n/a

Version	Status	Constraints
< 2.4.107	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25309
Advisory
https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3
x_refsource_MISCPatchThird Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25309		Advisory
https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3		x_refsource_MISCPatchThird Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj		x_refsource_CONFIRMThird Party Advisory