CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 59.4%

CVSS Severity

CVSS v3 Score 6.3

CVSS v2 Score 3.5

References

Products affected by CVE-2020-11055

Bookstackapp » Bookstack » Version: 0.18.0

cpe:2.3:a:bookstackapp:bookstack:0.18.0
Bookstackapp » Bookstack » Version: 0.18.1

cpe:2.3:a:bookstackapp:bookstack:0.18.1
Bookstackapp » Bookstack » Version: 0.18.2

cpe:2.3:a:bookstackapp:bookstack:0.18.2
Bookstackapp » Bookstack » Version: 0.18.3

cpe:2.3:a:bookstackapp:bookstack:0.18.3
Bookstackapp » Bookstack » Version: 0.18.4

cpe:2.3:a:bookstackapp:bookstack:0.18.4
Bookstackapp » Bookstack » Version: 0.18.5

cpe:2.3:a:bookstackapp:bookstack:0.18.5
Bookstackapp » Bookstack » Version: 0.19.0

cpe:2.3:a:bookstackapp:bookstack:0.19.0
Bookstackapp » Bookstack » Version: 0.20.0

cpe:2.3:a:bookstackapp:bookstack:0.20.0
Bookstackapp » Bookstack » Version: 0.20.1

cpe:2.3:a:bookstackapp:bookstack:0.20.1
Bookstackapp » Bookstack » Version: 0.20.2

cpe:2.3:a:bookstackapp:bookstack:0.20.2
Bookstackapp » Bookstack » Version: 0.20.3

cpe:2.3:a:bookstackapp:bookstack:0.20.3
Bookstackapp » Bookstack » Version: 0.21.0

cpe:2.3:a:bookstackapp:bookstack:0.21.0
Bookstackapp » Bookstack » Version: 0.22.0

cpe:2.3:a:bookstackapp:bookstack:0.22.0
Bookstackapp » Bookstack » Version: 0.23.0

cpe:2.3:a:bookstackapp:bookstack:0.23.0
Bookstackapp » Bookstack » Version: 0.23.1

cpe:2.3:a:bookstackapp:bookstack:0.23.1
Bookstackapp » Bookstack » Version: 0.23.2

cpe:2.3:a:bookstackapp:bookstack:0.23.2
Bookstackapp » Bookstack » Version: 0.24.0

cpe:2.3:a:bookstackapp:bookstack:0.24.0
Bookstackapp » Bookstack » Version: 0.24.1

cpe:2.3:a:bookstackapp:bookstack:0.24.1
Bookstackapp » Bookstack » Version: 0.24.2

cpe:2.3:a:bookstackapp:bookstack:0.24.2
Bookstackapp » Bookstack » Version: 0.24.3

cpe:2.3:a:bookstackapp:bookstack:0.24.3
Bookstackapp » Bookstack » Version: 0.25.0

cpe:2.3:a:bookstackapp:bookstack:0.25.0
Bookstackapp » Bookstack » Version: 0.25.1

cpe:2.3:a:bookstackapp:bookstack:0.25.1
Bookstackapp » Bookstack » Version: 0.25.2

cpe:2.3:a:bookstackapp:bookstack:0.25.2
Bookstackapp » Bookstack » Version: 0.25.3

cpe:2.3:a:bookstackapp:bookstack:0.25.3
Bookstackapp » Bookstack » Version: 0.25.4

cpe:2.3:a:bookstackapp:bookstack:0.25.4
Bookstackapp » Bookstack » Version: 0.25.5

cpe:2.3:a:bookstackapp:bookstack:0.25.5
Bookstackapp » Bookstack » Version: 0.26.0

cpe:2.3:a:bookstackapp:bookstack:0.26.0
Bookstackapp » Bookstack » Version: 0.26.1

cpe:2.3:a:bookstackapp:bookstack:0.26.1
Bookstackapp » Bookstack » Version: 0.26.2

cpe:2.3:a:bookstackapp:bookstack:0.26.2
Bookstackapp » Bookstack » Version: 0.26.3

cpe:2.3:a:bookstackapp:bookstack:0.26.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-11055

Products

Pricing

Contact Us