PT-2022-13559
CVE-2022-0960
·
Published
2022-03-14
·
Updated
2022-03-21
Description by
CVSS 3.1
9.0
CriticalMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
showdoc/showdoc versions prior to 2.10.4
Description
The issue allows attackers to execute malicious scripts in the user's browser through stored XSS via .properties file upload. This affects versions prior to 2.10.4. The problem was patched in version 2.10.4.
Recommendations
For versions prior to 2.10.4, update to version 2.10.4 to resolve the issue. As a temporary workaround, consider restricting the upload of .properties files until the update is applied.
Found an issue in the description? Have something to add? Feel free to write us 👾