Design/Logic Flaw

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin @backstage/plugin-techdocs prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This...

@backstage/plugin-api-docs (>=0.1.1-alpha.18, <=0.1.1), @backstage/plugin-catalog (>=0.0.0-nightly-202010102951, <=0.2.9) +20 more potentially affected by CVE-2021-32661 via @backstage/plugin-techdocs (>=0.0.0-nightly-20220708025041, <=0.5.8)

@backstage/plugin-techdocs NPM version =0.0.0-nightly-20220708025041, =0.1.1-alpha.18, =0.0.0-nightly-202010102951, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.17, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.9, =0.1.1-alpha.22, =0.1.1-alpha.13, =0.1.1-alpha.19, =0.0.0-nightly-20220504024625...

CVE-2021-32661

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin "@backstage/plugin-techdocs" prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an "object" element...

CVE-2021-32661

CVE-2021-32661 affects Backstage’s Techdocs Plugin, prior to version 0.9.5. A malicious internal actor could upload documentation content embedding a malicious script inside an HTML element, potentially accessing sensitive data when other users view the page. The root cause is improper handling ...

CVE-2021-32661 TechDocs object element script injection

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin @backstage/plugin-techdocs prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This...

CVE-2021-32660

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

CVE-2021-32660

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

Design/Logic Flaw

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

CVE-2021-32660

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

CVE-2021-32660

Backstage TechDocs: In @backstage/techdocs-common versions before 0.6.4, an internal actor can upload content containing malicious scripts. The scripts bypass frontend sanitization when content is viewed via the TechDocs API, potentially exposing sensitive data if the API shares origin with the B...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32660 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32660 Source advisory: MEND:CVE-2021-32660...

CVE-2021-32660 TechDocs content sanitization bypass

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

CVE-2021-32660

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of "@backstage/tehdocs-common" prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

PT-2021-19838

Name of the Vulnerable Software and Affected Versions @backstage/techdocs-common versions prior to 0.6.4 Description A malicious internal actor can upload documentation content with malicious scripts, which would normally be sanitized by the TechDocs frontend. However, by tricking a user into...

backstage code issues and vulnerabilities

Backstage is an open platform for building developer portals, and techdocs common contains the common features of Backstage's techdocs. An unspecified vulnerability exists in Backstage. An attacker can exploit the vulnerability to access sensitive data...

CVE-2021-32660: Improper Neutralization of Special Elements used in a Command

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

CVE-2021-32662: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is buil...

PT-2021-19840

Name of the Vulnerable Software and Affected Versions @backstage/techdocs-common versions prior to 0.6.3 Description A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs dir in mkdocs.yml. These...

CVE-2021-32661: Improper Neutralization of Special Elements used in a Command

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin @backstage/plugin-techdocs prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This...

Techdocs-common Path Traversal Vulnerability

NPM Techdocs-common is a package from npm USA. A path traversal vulnerability exists in Techdocs-common, which allows an attacker to read sensitive files from the environment where TechDocs documents are built and distributed by setting a specific path to "docsdir" in "mkdocs.yml"...