CVE-2024-34710
Assigner: GitHub_M
Published: 2024-05-20T21:59:16.606Z
State: PUBLISHED
title: Wiki.js Stored XSS through Client Side Template Injection 
problemTypes: descriptions: cweId: CWE-1336
description: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
affected: vendor: requarks
product: wiki
versions: version: <= 2.5.302
status: affected
descriptions: value: Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.

source: advisory: GHSA-xjcj-p2qv-q3rf
discovery: UNKNOWN