star7th/showdoc · Security
Stored Cross-site Scripting in showdoc
- GHSA ID
- GHSA-3pg8-c473-w6rr
- CVE ID
- CVE-2022-0967
- Severity
- medium
- Published
- Updated
- CVSS
- 6.9 · CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 6.9 · CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')