{"id":"CVE-2022-0877","aliases":["EUVD-2022-1328","GHSA-5rcc-6cmj-7728"],"status":"published","title":"Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack","description":"Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.","severity":{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00782,"percentile":0.56265,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-03-08T12:40:09Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Packagist","package":"ssddanbrown/bookstack","fixed_in":["22.02.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ssddanbrown/bookstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ssddanbrown/bookstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.3"}]}],"versions":["0.7.2","V0.7.5","v0.10.0","v0.11.0","v0.11.1","v0.11.2","v0.12.0","v0.12.1","v0.12.2","v0.13.0","v0.13.1","v0.14.0","v0.14.1","v0.14.2","v0.14.3","v0.15.0","v0.15.1","v0.15.2","v0.15.3","v0.16.0","v0.16.1","v0.16.2","v0.16.3","v0.17.0","v0.17.1","v0.17.2","v0.17.3","v0.17.4","v0.18.0","v0.18.1","v0.18.2","v0.18.3","v0.18.4","v0.18.5","v0.19.0","v0.20.0","v0.20.1","v0.20.2","v0.20.3","v0.21.0","v0.22.0","v0.23.0","v0.23.1","v0.23.2","v0.24.0","v0.24.1","v0.24.2","v0.24.3","v0.25.0","v0.25.1","v0.25.2","v0.25.3","v0.25.4","v0.25.5","v0.26.0","v0.26.1","v0.26.2","v0.26.3","v0.26.4","v0.27","v0.27.1","v0.27.2","v0.27.3","v0.27.4","v0.27.5","v0.28.0","v0.28.1","v0.28.2","v0.28.3","v0.29.0","v0.29.1","v0.29.2","v0.29.3","v0.30.0","v0.30.1","v0.30.2","v0.30.3","v0.30.4","v0.30.5","v0.30.6","v0.30.7","v0.31.0","v0.31.1","v0.31.2","v0.31.3","v0.31.4","v0.31.5","v0.31.6","v0.31.7","v0.31.8","v0.5.0","v0.6.0","v0.6.1","v0.6.2","v0.6.3","v0.7.0","v0.7.3","v0.7.4","v0.7.6","v0.8.0","v0.8.1","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.9.3","v21.04","v21.04.1","v21.04.2","v21.04.3","v21.04.4","v21.04.5","v21.04.6","v21.05","v21.05.1","v21.05.2","v21.05.3","v21.05.4","v21.08","v21.08.1","v21.08.2","v21.08.3","v21.08.4","v21.08.5","v21.08.6","v21.10","v21.10.1","v21.10.2","v21.10.3","v21.11","v21.11.1","v21.11.2","v21.11.3","v21.12","v21.12.1","v21.12.2","v21.12.3","v21.12.4","v21.12.5","v22.02","v22.02.1","v22.02.2"]}],"products":[{"vendor":"bookstackapp","product":"bookstack"},{"vendor":"bookstackapp","product":"bookstackapp/bookstack"}],"references":[{"url":"https://huntr.dev/bounties/b04df4e3-ae5a-4dc6-81ec-496248b15f3c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/bookstackapp/bookstack/commit/856fca8289b7370cafa033ea21c408e7d4303fd6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0877","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5rcc-6cmj-7728"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0877.json","tags":["advisory"]},{"url":"https://github.com/bookstackapp/bookstack","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-0877","title":"Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack","description":"Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.","status":"published","published":"2022-03-08T12:40:09Z","modified":"2024-08-02T23:40:04.559Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-1328","description":"Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.","status":"published","published":"2022-03-08T12:40:09Z","modified":"2024-08-02T23:40:04Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T03:26:03.912978Z"}],"ghsa":[{"id":"GHSA-5rcc-6cmj-7728","title":"Cross-site Scripting in BookStack","description":"Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.","status":"published","published":"2022-03-09T00:00:44Z","modified":"2023-02-03T05:06:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:44.093794Z"}],"nvd":[{"id":"CVE-2022-0877","description":"Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.","status":"published","published":"2022-03-08T13:15:08.153Z","modified":"2026-06-17T04:21:24.857Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"CVE-2022-0877","title":"Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack","description":"Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.","status":"published","published":"2022-03-08T12:40:09Z","modified":"2026-10-28T02:30:39.871772876Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"GHSA-5rcc-6cmj-7728","title":"Cross-site Scripting in BookStack","description":"Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.","status":"published","published":"2022-03-09T00:00:44Z","modified":"2023-11-08T04:07:41.697904Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}