Stored XSS via search result in Wiki.js
CVE-2020-15274

5.8MEDIUM

Key Information:

Vendor

Requarks

Status
Wiki.js
Vendor
CVE Published:
26 October 2020

What is CVE-2020-15274?

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.

Affected Version(s)

wiki.js < 2.5.162

References

https://github.com/Requarks/wiki/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/Requarks/wiki/commit/a57d9af34c15adbf4...
x_refsource_MISC
https://docs.requarks.io/releases
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.