Vulnerability · Published Sep 17, 2024 · Assigned by GitHub_M
CVE-2024-46976Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend
Medium 6.5
In plain English
A medium-severity security flaw in backstage from backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @backstage/plugin-techdocs-backend | 1.10.13 | GHSA-5j94-f3mf-8685 |
Affected products (as reported)
Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
References
- https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685 x_refsource_CONFIRM