Skip to content

Publify vulnerable to cross site scripting

Critical severity GitHub Reviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Aug 25, 2023

Package

bundler publify_core (RubyGems)

Affected versions

< 9.2.9

Patched versions

9.2.9

Description

Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file. Stored XSS may be obtained.

References

Published by the National Vulnerability Database May 23, 2022
Published to the GitHub Advisory Database May 24, 2022
Reviewed Jun 3, 2022
Last updated Aug 25, 2023

Severity

Critical
9.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Weaknesses

CVE ID

CVE-2022-1811

GHSA ID

GHSA-3hwx-c6cp-q972

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.