PT-2020-17853 · Wiki.Js · Wiki.Js

Denandz · Published 2020-06-16 · Updated 2020-06-22 · CVE-2020-4052

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Wiki.js versions prior to 2.4.107

Description The issue is caused by an insecure validation mechanism that fails to properly insert v-pre tags into rendered HTML elements containing curly-braces, leading to a stored cross-site scripting vulnerability through template injection. This allows a malicious user to create a crafted wiki page, staging a stored cross-site scripting attack that executes malicious JavaScript when the page is viewed by other users.

Recommendations For versions prior to 2.4.107, update to version 2.4.107 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-4052

GHSA-9JGG-4XJ2-VJJJ

Affected Products

Wiki.Js

References · 4

• https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3 · Patch
• https://osv.dev/vulnerability/CVE-2020-4052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4052 · Security Note
• https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj · Note