CVE-2021-25993: fallo de gravedad media en Requarks wiki
Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.6%
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Requarks · wikiCVEs relacionadas — Requarks wiki
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-43800HIGHAsset directory traversal with some storage modules on WindowsEPSS 1.8%CVE-2020-15236HIGHDirectory Traversal in Wiki.jsEPSS 1.8%CVE-2021-21383HIGHXSS in Wiki.jsEPSS 1.0%CVE-2021-43855HIGHStored XSS via SVG in Requarks/wikiEPSS 0.9%CVE-2021-43856HIGHStored XSS in non-image uploads in Requarks/wikiEPSS 0.9%CVE-2021-43842MEDIUMStored XSS via SVG file upload in Wiki.jsEPSS 0.7%