CVE-2024-46976 Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attack...

CVE-2024-45816: Relative Path Traversal

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A security vulnerability exists in versions prior to Backstage 1.10.13 that stems from the possibility of accessing the contents of an entire storage bucket when using AWS S3 or GCS...

CVE-2024-46976: Protection Mechanism Failure

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attack...

Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. Backstage 1.10.13 security vulnerability , the vulnerability stems from the TechDocs storage bucket content controlled by an attacker , able to inject in the TechDocs content can be...

PT-2024-9770 · Unknown · @Backstage/Plugin-Techdocs-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-techdocs-backend versions prior to 1.10.13 Description: The issue allows an attacker with control of the TechDocs storage buckets to inject executable scripts in the TechDocs content. These scripts will be executed in the...

PT-2024-9768 · Google +2 · Gcs +2

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-techdocs-backend versions prior to 1.10.13 Description: The issue is related to the Backstage platform, an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs, it is...

WS-2022-0154

A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when "techdocs.publisher.type" is set to "local". This vulnerability is mitigated by the fact that the Software Catalog must be configure...

Malicious code in techdocs-cli-embedded-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6523ca476cc6b141bf6eb3cc01162248af09aeb7f527940ba0927c5961fbf35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6445 Malicious code in techdocs-cli-embedded-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6523ca476cc6b141bf6eb3cc01162248af09aeb7f527940ba0927c5961fbf35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Path traversal for local publishers in TechDocs backend

Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catalog must be...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=0.14.1), @backstage/techdocs-common (>=0.11.13, <=0.11.15) +1 more potentially affected by unknown CVE via @backstage/plugin-techdocs-node (>=1.0.0, <=1.1.1-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =0.8.16 Source cves: unknown CVE Source advisory: OSV:GHSA-4JQC-JVH2-PXG9...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by unknown CVE via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.11.15)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-2021102622333, =0.8.16 Source cves: unknown CVE Source advisory: OSV:GHSA-4JQC-JVH2-PXG9...

GHSA-4JQC-JVH2-PXG9 Path traversal for local publishers in TechDocs backend

Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catalog must be...

Welcome to Akamai TechDocs

We're pleased to announce the launch of Akamai’s brand-new documentation site: techdocs.akamai.com. Powered by ReadMe, our new site offers intuitive and interactive content designed to help you get the most out of your Akamai products...

Directory Traversal

@backstage/techdocs-common is vulnerable to directory traversal. An attacker can read arbitrary system files from the environment where TechDocs documentation is built and published by setting a particular path for docsdir in mkdocs.yml...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32660 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32660 Source advisory: OSV:GHSA-PWHF-39XG-4RXW...

Script injection

Impact A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is...

GHSA-PWHF-39XG-4RXW Script injection

Impact A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is...

@backstage/plugin-api-docs (>=0.1.1-alpha.18, <=0.1.1), @backstage/plugin-catalog (>=0.0.0-nightly-202010102951, <=0.2.9) +20 more potentially affected by CVE-2021-32661 via @backstage/plugin-techdocs (>=0.0.0-nightly-20220708025041, <=0.5.8)

@backstage/plugin-techdocs NPM version =0.0.0-nightly-20220708025041, =0.1.1-alpha.18, =0.0.0-nightly-202010102951, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.17, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.9, =0.1.1-alpha.22, =0.1.1-alpha.13, =0.1.1-alpha.19, =0.0.0-nightly-20220504024625...