Lucene search

GitHub Advisory DatabaseGHSA-WMH9-X28J-C6GR

HistoryMay 24, 2022 - 10:29 p.m.

Cross site scripting in publify

2022-05-2422:29:03

CWE-79

GitHub Advisory Database

github.com

publify

cross site scripting

vulnerability

stored xss

javascript

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.4%

JSON

In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.

Affected configurations

Vulners

Node

publify_projectpublifyRange8.0–9.2.5

VendorProductVersionCPE
publify_projectpublify*cpe:2.3:a:publify_project:publify:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
publify_project	publify	*	cpe:2.3:a:publify_project:publify::::::::

References

github.com/advisories/GHSA-wmh9-x28j-c6gr

github.com/publify/publify/commit/fefd5f76302adcc425b2b6e7e7d23587cfc0083e

nvd.nist.gov/vuln/detail/CVE-2021-25974

www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.4%

JSON

Related for GHSA-WMH9-X28J-C6GR