CVE-2020-26287

Katalog CVE

CVSS 8.7 · High EPSS 1,5%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada hedgedoc. Skor CVSS 3.1 8.7 (High) menurut NVD.

Deskripsi (NVD)

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.

Rincian

Terbit di NVD

29 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4 patch · advisory pihak ketiga
• https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.md exploit · advisory pihak ketiga
• https://github.com/hackmdio/codimd/issues/1630 advisory pihak ketiga
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 advisory pihak ketiga
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p advisory pihak ketiga