CVE-2024-34710CWE-1336

Wiki.js Stored XSS through Client Side Template Injection

High · published May 20, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.5th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2024-05-20T21:59Z
EPSS history
Timeline
  • 20 MAY 21:59Z
    Wiki.js Stored XSS through Client Side Template Injection
    cvelistv5