Cross-site Scripting in BookWyrm
CVE-2022-31136

6.3MEDIUM

Key Information:

Vendor

Bookwyrm-social

Status
Bookwyrm
Vendor
CVE Published:
7 July 2022

What is CVE-2022-31136?

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.

Affected Version(s)

bookwyrm < 0.4.1

References

https://github.com/bookwyrm-social/bookwyrm/security/advi...
x_refsource_CONFIRM
https://github.com/bookwyrm-social/bookwyrm/commit/fe33fd...
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.