CVE-2020-11051: XSS in Wiki.js
In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-11051?
CVE-2020-11051 is a stored XSS vulnerability in Wiki.js before version 2.3.81.
What is the severity of CVE-2020-11051?
The severity of CVE-2020-11051 is medium with a CVSS score of 4.8.
How does CVE-2020-11051 impact Wiki.js?
CVE-2020-11051 allows an attacker with write access to a page in Wiki.js to inject a stored XSS payload into the content.
How can an attacker exploit CVE-2020-11051?
An attacker with write access to a page in Wiki.js can inject an XSS payload into the content, which will be executed when another editor with write access loads the same page in the Markdown editor.
How can I fix CVE-2020-11051?
To fix CVE-2020-11051, update to Wiki.js version 2.3.81 or later.