CVE-2024-34710
Wiki.js Stored XSS through Client Side Template Injection
- State
- Published
- Severity
- 7.1 High
- Published
- May 20, 2024
- Updated
- Aug 2, 2024
- Reserved
- May 7, 2024
Description
Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | GitHub_M |
Weaknesses
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected Products
| Product | Versions |
|---|---|
wikirequarks |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.