PT-2018-11016 · Airbnb · Airbnb Knowledge Repo

Ekzorcisto · Published 2018-06-17 · Updated 2022-05-14 · CVE-2018-12104

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Airbnb Knowledge Repo versions 0.7.4 through 0.8.x Airbnb Knowledge Repo versions prior to 0.9.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the "post/posts/new report.kp" URI. This could potentially affect a significant number of devices, but the exact number is not specified.

Recommendations For Airbnb Knowledge Repo versions 0.7.4 through 0.8.x, update to version 0.9.0 or later. For Airbnb Knowledge Repo versions prior to 0.9.0, update to version 0.9.0 or later. As a temporary workaround, consider restricting access to the post comments functionality until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-12104

GHSA-XMW7-848P-P95W

PYSEC-2018-116

Affected Products

Airbnb Knowledge Repo

References · 13

• 🔥 https://github.com/airbnb/knowledge-repo/issues/431 · Exploit
• https://osv.dev/vulnerability/GHSA-xmw7-848p-p95w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12104 · Security Note
• https://osv.dev/vulnerability/PYSEC-2018-116 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12104 · Vendor Advisory
• https://github.com/airbnb/knowledge-repo/issues/254 · Note
• https://github.com/airbnb/knowledge-repo/pull/558 · Note
• https://github.com/airbnb/knowledge-repo/commit/f026ad2afea14e0ffc91f1aa0eaedcdc72c63167 · Note
• https://github.com/airbnb/knowledge-repo · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/knowledge-repo/PYSEC-2018-116.yaml · Note
• https://pypi.org/project/knowledge-repo · Note
• http://securityfocus.com/bid/104487 · Note
• https://web.archive.org/web/20200227121013/http://securityfocus.com/bid/104487 · Note