Lucene search
GoogleOSV:CVE-2020-7680HistoryJul 20, 2020 - 4:15 p.m.
CVE-2020-7680
2020-07-2016:15:12
Google
osv.dev
11
cve-2020-7680
cross-site scripting
docsify.js
fragment identifiers
external urls
javascript/html
security vulnerability
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
References
packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.html
packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2021/Feb/71
github.com/docsifyjs/docsify/issues/1126
github.com/docsifyjs/docsify/pull/1128
snyk.io/vuln/SNYK-JS-DOCSIFY-567099
Related
nodejs
nodejs
Cross-Site Scripting (XSS)
2021-05-18 01:58:00
cvelist
cvelist
CVE-2020-7680
2020-07-20 15:22:13
CVE-2021-23342 Cross-site Scripting (XSS)
2021-02-19 16:35:15
veracode
veracode
Cross-site Scripting (XSS)
2020-07-21 01:54:34
exploitdb
exploitdb
Docsify.js 4.11.4 - Reflective Cross-Site Scripting
2020-07-22 00:00:00
osv
osv
Cross-site Scripting in docsify
2021-05-18 01:53:18
Docsify XSS Vulnerability
2021-03-01 19:44:27
CVE-2021-23342
2021-02-19 17:15:13
github
github
Cross-site Scripting in docsify
2021-05-18 01:53:18
Docsify XSS Vulnerability
2021-03-01 19:44:27
nvd
nvd
CVE-2020-7680
2020-07-20 16:15:12
CVE-2021-23342
2021-02-19 17:15:13
packetstorm
packetstorm
Docsify.js 4.11.4 Cross Site Scripting
2020-07-22 00:00:00
cve
cve
CVE-2020-7680
2020-07-20 16:15:12
CVE-2021-23342
2021-02-19 17:15:13
zdt
zdt
Docsify 4.11.4 - Reflective Cross-Site Scripting Vulnerability
2020-07-22 00:00:00
docsify 4.11.6 Cross Site Scripting Vulnerability
2021-02-22 00:00:00
prion
prion
Cross site scripting
2020-07-20 16:15:00
Authentication flaw
2021-02-19 17:15:00