Vulnerability · Published Jul 7, 2022 · Assigned by GitHub_M

CVE-2022-31136Cross-site Scripting in BookWyrm

Medium 6.3

In plain English

A medium-severity cross-site scripting in bookwyrm from bookwyrm-social. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
bookwyrm-social	bookwyrm	< 0.4.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-2cfh-v7rf-pxfp x_refsource_CONFIRM
https://github.com/bookwyrm-social/bookwyrm/commit/fe33fdcf564a6a5667aef75d5456bea08feab50d x_refsource_MISC