CVE-2024-46976CWE-693

Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend

Medium · published September 17, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.2th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2024-09-17T20:12Z
EPSS history
Timeline
  • 17 SEP 20:12Z
    Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend
    cvelistv5