CVE-2022-40690 - Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script

MEDIUM

Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script

Published Oct 24, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.77%

Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.

Vendor BookStack Product BookStack Default
unknown
Affected
- versions prior to v22.09

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
BookStack	BookStack	unknown	Affected versions prior to v22.09

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43961		Advisory
https://jvn.jp/en/jp/JVN78862034/index.html		Release NotesThird Party Advisory
https://www.bookstackapp.com/blog/bookstack-release-v22-09/		Release NotesVendor Advisory
https://www.bookstackapp.com/docs/admin/security/#using-bookstack-content-externally		Vendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner jpcert

Published Oct 24, 2022

Updated May 7, 2025

Reserved Sep 26, 2022

CISA Vulnrichment

Updated May 7, 2025

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner jpcert

Published Oct 24, 2022

Updated May 7, 2025

GitHub

No data