Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:30803
HistoryJun 04, 2021 - 5:48 a.m.

Information Disclosure

2021-06-0405:48:57
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
information disclosure
documentation
malicious scripts
techdocs api
confidential data
vulnerability

EPSS

0.002

Percentile

51.6%

@backstage/techdocs-common is vulnerable to information disclosure. An attacker is able bypass sanitization by uploading documentation content with malicious scripts that would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitization will be bypassed and the attacker may gain access to confidential data.

EPSS

0.002

Percentile

51.6%

Related for VERACODE:30803