Cross-site Scripting in showdoc/showdoc

2022-03-1500:00:55

Google

osv.dev

0.001 Low

EPSS

Percentile

21.6%

JSON

ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user’s browser. This issue was patched in version 2.10.4. There is currently no known workaround.

CPENameOperatorVersion
showdoc/showdoceq1.0.3
showdoc/showdoceq2.1.0
showdoc/showdoceq2.9.5
showdoc/showdoceq2.3.1
showdoc/showdoceq2.8.15
showdoc/showdoceq1.8.0
showdoc/showdoceq2.3.0
showdoc/showdoceq1.4.0
showdoc/showdoceq1.3.3
showdoc/showdoceq1.6.2

Name	Operator	Version
showdoc/showdoc	eq	1.0.3
showdoc/showdoc	eq	2.1.0
showdoc/showdoc	eq	2.9.5
showdoc/showdoc	eq	2.3.1
showdoc/showdoc	eq	2.8.15
showdoc/showdoc	eq	1.8.0
showdoc/showdoc	eq	2.3.0
showdoc/showdoc	eq	1.4.0
showdoc/showdoc	eq	1.3.3
showdoc/showdoc	eq	1.6.2