PT-2022-13556 · Showdoc · Showdoc

Published 2022-03-15 · Updated 2022-03-22 · CVE-2022-0957

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions showdoc versions prior to 2.10.4

Description The issue is related to stored cross-site scripting (XSS) via file upload. This means an attacker could potentially upload a malicious file that, when accessed, executes scripts in the context of the vulnerable application, potentially leading to unauthorized actions or data theft. The estimated number of potentially affected devices or real-world incidents is not specified.

Recommendations For showdoc versions prior to 2.10.4, update to version 2.10.4 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the file upload feature until the update can be applied. Additionally, restrict access to uploaded files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0957

GHSA-Q73M-3Q7R-FPF7

Affected Products

Showdoc

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0957.json · Exploit
• 🔥 https://huntr.dev/bounties/b4918d45-b635-40db-bb4b-34035e1aca21 · Exploit
• https://github.com/star7th/showdoc/commit/d1c9ed0d77ea5d56f09be0c492361dca8af745bb · Patch
• https://osv.dev/vulnerability/CVE-2022-0957 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q73m-3q7r-fpf7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0957 · Security Note
• https://github.com/star7th/showdoc · Note
• https://github.com/star7th/showdoc/pull/1632 · Note
• https://t.me/cibsecurity/38916 · Telegram Post