PT-2020-16341 · Bookstack · Bookstack

Published 2020-11-03 · Updated 2022-05-24 · CVE-2020-26211

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 0.30.4

Description A user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If the issue could have been exploited, a SQL query can be used to test.

Recommendations For versions prior to 0.30.4, upgrade to BookStack version 0.30.4 to fix the issue. As a temporary workaround without upgrading, limit page edit permissions to only those that are trusted until you can upgrade, although this will not address existing exploitation of this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26211

GHSA-CH37-CH8W-CFRQ

GHSA-R2CF-8778-3JGP

Affected Products

Bookstack

References · 10

• https://github.com/BookStackApp/BookStack/commit/bbd1384acbe7e52c21f89af69f2dc391c95dbf54 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26211 · Security Note
• https://bookstackapp.com/blog/beta-release-v0-30-4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26211 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ch37-ch8w-cfrq · Vendor Advisory
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-r2cf-8778-3jgp · Note
• https://github.com/BookStackApp/BookStack/releases/tag/v0.30.4 · Note
• https://github.com/BookStackApp/BookStack · Note
• https://t.me/cibsecurity/15820 · Telegram Post
• https://t.me/cvenotify/5610 · Telegram Post