CVE-2020-15274: Stored XSS via search result in Wiki.js
In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-15274?
CVE-2020-15274 is a vulnerability in Wiki.js before version 2.5.162 that allows an XSS payload to be injected in a page title and executed via the search results.
What is the severity of CVE-2020-15274?
The severity of CVE-2020-15274 is medium, with a severity value of 5.4.
How does CVE-2020-15274 affect Requarks wiki.js?
CVE-2020-15274 affects Requarks wiki.js versions up to but excluding 2.5.162.
How can CVE-2020-15274 be exploited?
CVE-2020-15274 can be exploited by injecting an XSS payload in a page title and executing it via the search results.
Is there a fix for CVE-2020-15274?
Yes, the fix for CVE-2020-15274 is available in version 2.5.162 of Wiki.js.