PT-2022-13559 · Showdoc · Showdoc

Published 2022-03-14 · Updated 2022-03-21 · CVE-2022-0960

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions showdoc/showdoc versions prior to 2.10.4

Description The issue allows attackers to execute malicious scripts in the user's browser through stored XSS via .properties file upload. This affects versions prior to 2.10.4. The problem was patched in version 2.10.4.

Recommendations For versions prior to 2.10.4, update to version 2.10.4 to resolve the issue. As a temporary workaround, consider restricting the upload of .properties files until the update is applied.

Exploit

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

CVE-2022-0960

GHSA-RPHC-H572-2X9F

Affected Products

Showdoc

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0960.json · Exploit
• 🔥 https://huntr.dev/bounties/462cd8a7-b1a9-4e93-af71-b56ba1d7ad4e · Exploit
• https://github.com/star7th/showdoc/commit/92bc6a83a3a60e01a0d2effb98ab47d8d7eab28f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0960 · Security Note
• https://osv.dev/vulnerability/GHSA-rphc-h572-2x9f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0960 · Vendor Advisory
• https://github.com/star7th/showdoc · Note