PT-2022-13551 · Showdoc · Showdoc

Published 2022-03-15 · Updated 2022-03-21 · CVE-2022-0951

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ShowDoc versions prior to 2.10.4

Description The issue is related to a file upload restriction bypass, which can lead to stored cross-site scripting. This means an attacker could potentially upload malicious files, bypassing the restrictions in place, and execute scripts on the victim's browser.

Recommendations For versions prior to 2.10.4, update to version 2.10.4 or later to resolve the issue.

Exploit

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

CVE-2022-0951

GHSA-J6JG-W79C-7P8V

Affected Products

Showdoc

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0951.json · Exploit
• 🔥 https://huntr.dev/bounties/b3a983a3-17f9-4aa8-92d7-8a0c92a93932 · Exploit
• https://github.com/star7th/showdoc/commit/237ac6d43bf3728bf3587c486a23b4a48ea7acb3 · Patch
• https://osv.dev/vulnerability/GHSA-j6jg-w79c-7p8v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0951 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0951 · Vendor Advisory
• https://github.com/star7th/showdoc · Note