CVE-2020-15274CWE-79

Stored XSS via search result in Wiki.js

Medium · published October 26, 2020

CVSS v3.1
5.8
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00765 · 54.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-10-26T18:35Z
EPSS history
Timeline
  • 26 OCT 18:35Z
    Stored XSS via search result in Wiki.js
    cvelistv5