GitHub_MCVELIST:CVE-2020-26260CVE-2020-26260 Server Side Request Forgery in BookStack
6.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
27.0%
BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL’s to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wider scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade.
CNA Affected
[
{
"product": "BookStack",
"vendor": "BookStackApp",
"versions": [
{
"status": "affected",
"version": ">= v0.7, < v0.30.5"
}
]
}
]Related
6.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
27.0%