PT-2018-11016 · Airbnb · Airbnb Knowledge Repo

Ekzorcisto · Publicado 2018-06-17 · Atualizado 2022-05-14 · CVE-2018-12104

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Airbnb Knowledge Repo versions 0.7.4 through 0.8.x Airbnb Knowledge Repo versions prior to 0.9.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the "post/posts/new report.kp" URI. This could potentially affect a significant number of devices, but the exact number is not specified.

Recommendations For Airbnb Knowledge Repo versions 0.7.4 through 0.8.x, update to version 0.9.0 or later. For Airbnb Knowledge Repo versions prior to 0.9.0, update to version 0.9.0 or later. As a temporary workaround, consider restricting access to the post comments functionality until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-12104

GHSA-XMW7-848P-P95W

PYSEC-2018-116

Produtos afetados

Airbnb Knowledge Repo

Referências · 13

• 🔥 https://github.com/airbnb/knowledge-repo/issues/431 · Exploit
• https://github.com/airbnb/knowledge-repo/issues/254 · Nota
• https://github.com/airbnb/knowledge-repo/pull/558 · Nota
• https://github.com/airbnb/knowledge-repo/commit/f026ad2afea14e0ffc91f1aa0eaedcdc72c63167 · Nota
• https://github.com/airbnb/knowledge-repo · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/knowledge-repo/PYSEC-2018-116.yaml · Nota
• https://osv.dev/vulnerability/GHSA-xmw7-848p-p95w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12104 · Nota de Segurança
• https://pypi.org/project/knowledge-repo · Nota
• http://securityfocus.com/bid/104487 · Nota
• https://osv.dev/vulnerability/PYSEC-2018-116 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-12104 · Aviso do Fabricante
• https://web.archive.org/web/20200227121013/http://securityfocus.com/bid/104487 · Nota