PT-2022-13565 · Showdoc · Showdoc

Published 2022-03-15 · Updated 2022-03-22 · CVE-2022-0966

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShowDoc versions prior to 2.10.4 ShowDoc versions prior to 2.4.10

Description The issue is related to stored cross-site scripting (XSS) via file upload. This means an attacker could potentially upload a malicious file that, when accessed, executes scripts in the context of the vulnerable application, leading to unauthorized actions or data theft.

Recommendations For versions prior to 2.4.10, update to version 2.4.10 or later. For versions prior to 2.10.4, update to version 2.10.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0966

GHSA-G585-J55V-38H7

Affected Products

Showdoc

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0966.json · Exploit
• 🔥 https://huntr.dev/bounties/e06c0d55-00a3-4f82-a009-0310b2e402fe · Exploit
• https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0966 · Security Note
• https://osv.dev/vulnerability/GHSA-g585-j55v-38h7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0966 · Vendor Advisory
• https://github.com/star7th/showdoc · Note