star7th/showdoc · Security
Cross-site Scripting in showdoc/showdoc
- GHSA ID
- GHSA-rphc-h572-2x9f
- CVE ID
- CVE-2022-0960
- Severity
- critical
- Published
- Updated
- CVSS
- 9 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 9 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Description
ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-434 · Unrestricted Upload of File with Dangerous Type