CVE-2024-34710

May 20, 2024, 10:15 p.m.

Tags

security-advisories@github.com
2024-05-20
CWE-1336
CVE-2024-34710

CVSS Score

7.1 / 10

Product(s) Impacted

Wiki.js

  • 2.5.303

Description

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.

Weaknesses

Date

Published: May 20, 2024, 10:15 p.m.

Last Modified: May 20, 2024, 10:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

Base Score
7.1
Exploitability Score
Impact Score
Base Severity
HIGH
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac
security-advisories@github.com
https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf
security-advisories@github.com