Kurz gesagt
- CVE-2017-16019 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in gitbook (gitbook), gitbook.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.92%, höher als bei 60.5% aller Schwachstellen.
- Abhilfe: auf 3.2.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| gitbook | < 3.2.2
| 3.2.2
|
| gitbook npm | < 3.2.2
| 3.2.2
|
Description
Affected versions of gitbook do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.
Recommendation
Update to version 3.2.2 or later.
NVD description
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free