CVE-2021-25993CWE-79

Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

Medium · published December 29, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00639 · 50.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-29T16:50Z
EPSS history
Timeline
  • 29 DEC 16:50Z
    Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor
    cvelistv5