Vulnerability · Published Jun 16, 2020 · Assigned by GitHub_M

CVE-2020-4052Stored XSS through template injection in Wiki.js

Medium 6.3

In plain English

A medium-severity cross-site scripting in Wiki.js from Requarks.io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.

Affected products (as reported)

Vendor	Product	Versions
Requarks.io	Wiki.js	< 2.4.107

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj x_refsource_CONFIRM
https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3 x_refsource_MISC