Vulnerability · Published Dec 9, 2020 · Assigned by GitHub_M

CVE-2020-26260Server Side Request Forgery in BookStack

Medium 6.4

In plain English

A medium-severity injection in BookStack from BookStackApp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wider scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade.

Affected products (as reported)

Vendor	Product	Versions
BookStackApp	BookStack	>= v0.7, < v0.30.5

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/BookStackApp/BookStack/security/advisories/GHSA-8wfc-w2r5-x7cr x_refsource_CONFIRM
https://bookstackapp.com/blog/beta-release-v0-30-5/ x_refsource_MISC
https://github.com/BookStackApp/BookStack/releases/tag/v0.30.5 x_refsource_MISC