En bref
- CVE-2017-16019 est une vulnérabilité MOYENNE (CVSS 6.1) touchant gitbook (gitbook), gitbook.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.92%, plus élevée que 60.5% des vulnérabilités.
- Correctif : mettre à jour vers 3.2.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| gitbook | < 3.2.2
| 3.2.2
|
| gitbook npm | < 3.2.2
| 3.2.2
|
Description
Affected versions of gitbook do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.
Recommendation
Update to version 3.2.2 or later.
NVD description
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free