CVE-2021-21383

Sep 3, 2024

Published Date: 2021-03-18T17:15Z
Last Modified: 2021-03-24T14:00Z

CVSS Score: 5.4 (MEDIUM)

EPSS Score: 0.06%

Risk Score: 3.78 (MEDIUM)

Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.

Meter Needle
CVSS: 5.4  |  EPSS: 0.06%

Description: Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained within a `

` element. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. For an example see referenced GitHub Security Advisory. Commit 5ffa189383dd716f12b56b8cae2ba0d075996cf1 fixes this vulnerability by adding the v-pre directive to all `

` tags during the render.

Mitre ATT&CK Technical v15.1

T1059.007 – JavaScript
T1659 – Content Injection
T1153 – Source
T1064 – Scripting
T1053.002 – At

Technical Analysis & Mitigation Measures

Reference Links

Vendor - Produce - Version

wiki.js - requarks

Disclaimer

The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.