PT-2022-20556 · Bookwyrm · Bookwyrm

Vovikhangcdv · Published 2022-07-07 · Updated 2022-07-15 · CVE-2022-31136

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bookwyrm versions prior to 0.4.1

Description The issue concerns an open source social reading and reviewing program where versions prior to 0.4.1 did not properly sanitize HTML being rendered to users. Unprivileged users can inject scripts into user profiles, book descriptions, and statuses, potentially leading to cross-site scripting attacks on users viewing these fields.

Recommendations For versions prior to 0.4.1, upgrade to version 0.4.1 to resolve the issue. As a temporary workaround, consider restricting access to user profiles, book descriptions, and statuses until the upgrade is applied. Avoid using the affected fields in the program until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31136

GHSA-2CFH-V7RF-PXFP

Affected Products

Bookwyrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31136.json · Exploit
• https://github.com/bookwyrm-social/bookwyrm/commit/fe33fdcf564a6a5667aef75d5456bea08feab50d · Patch
• https://osv.dev/vulnerability/CVE-2022-31136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31136 · Security Note
• https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-2cfh-v7rf-pxfp · Note
• https://t.me/cibsecurity/45763 · Telegram Post
• https://t.me/cvenotify/33146 · Telegram Post