CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
EPSS
Percentile
43.6%
Severity: Medium
Date : 2021-01-12
CVE-ID : CVE-2020-26297
Package : mdbook
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-1399
The package mdbook before version 0.4.5-1 is vulnerable to cross-site
scripting.
Upgrade to 0.4.5-1.
The problem has been fixed upstream in version 0.4.5.
None.
The search feature of mdBook (introduced in version 0.1.4) was affected
by a cross site scripting vulnerability that allowed an attacker to
execute arbitrary JavaScript code on an user’s browser by tricking the
user into typing a malicious search query, or tricking the user into
clicking a link to the search page with the malicious search query
prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping
the search query.
A malicious user can execute arbitrary code in a user’s browser with a
malicious search query.
https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0
https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606
https://security.archlinux.org/CVE-2020-26297
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
EPSS
Percentile
43.6%