En resumen
- CVE-2017-16019 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a gitbook (gitbook), gitbook.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.92%, mayor que el 60.6% de las vulnerabilidades.
- Solución: actualizar a 3.2.2 o posterior.
| Package | Affected versions | Patched versions |
|---|
| gitbook | < 3.2.2
| 3.2.2
|
| gitbook npm | < 3.2.2
| 3.2.2
|
Description
Affected versions of gitbook do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.
Recommendation
Update to version 3.2.2 or later.
NVD description
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free