CVE-2020-11051

MEDIUM EPSS 44.7%
Published May 5, 20206y ago · Modified Jun 17, 20262w ago
4.8 CVSS 3.1
Medium
Find Similar
Published May 5, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.

CVSS Details

Base Score
4.8
Exploitability
1.7
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
44.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
requarkswiki.js* <2.3.81

References 2

  • github.com https://github.com/Requarks/wiki/commit/05e8a71ceff39167aee830ba8ad5eb0161f2911a
    PatchThird Party Advisory
  • github.com https://github.com/Requarks/wiki/security/advisories/GHSA-vj72-c9vq-qxrv
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/Requarks/wiki/commit/05e8a71ceff39167aee830ba8ad5eb0161f2911a
    PatchThird Party Advisory
  • github.com https://github.com/Requarks/wiki/security/advisories/GHSA-vj72-c9vq-qxrv
    PatchThird Party Advisory