Platform
php
Component
showdoc
Fixed in
v2.10.4
CVE-2022-0946 is a stored Cross-Site Scripting (XSS) vulnerability affecting Showdoc versions up to 2.10.4. This vulnerability allows attackers to inject malicious scripts through the upload of specially crafted cshtm files. Successful exploitation can lead to account takeover and data theft. The vulnerability was published on March 14, 2022, and a patch is available in version 2.10.4.
The XSS vulnerability in Showdoc arises from insufficient sanitization of user-uploaded cshtm files. An attacker can upload a malicious cshtm file containing JavaScript code. When a user views the uploaded file, the embedded script executes within their browser context, allowing the attacker to steal cookies, redirect the user to a malicious website, or perform actions on their behalf. The impact is significant, potentially leading to complete account compromise and unauthorized access to sensitive data stored within Showdoc. This vulnerability is particularly concerning given Showdoc’s potential use in internal documentation and knowledge management systems, where sensitive information is often stored.
CVE-2022-0946 is not currently listed on the CISA KEV catalog. Public proof-of-concept (PoC) code is available, indicating a moderate risk of exploitation. The vulnerability's ease of exploitation and potential impact suggest that attackers may actively target vulnerable Showdoc installations. The NVD entry was published on March 14, 2022.
Exploit Status
EPSS
0.32% (55% percentile)
CVSS Vector
The primary mitigation for CVE-2022-0946 is to upgrade Showdoc to version 2.10.4 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file uploads to trusted sources, implementing strict input validation on all user-provided data, and utilizing a Web Application Firewall (WAF) to filter out potentially malicious requests. Carefully review any third-party plugins or extensions for Showdoc, as they may introduce additional vulnerabilities. After upgrading, confirm the fix by attempting to upload a test cshtm file containing a simple JavaScript alert and verifying that the alert does not execute.
Actualice showdoc a la versión 2.10.4 o superior. Esta versión contiene una corrección para la vulnerabilidad XSS almacenada. La actualización se puede realizar descargando la última versión del repositorio y reemplazando los archivos existentes.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2022-0946 is a stored Cross-Site Scripting (XSS) vulnerability in Showdoc versions up to 2.10.4, allowing attackers to inject malicious scripts via file uploads.
You are affected if you are running Showdoc versions prior to 2.10.4. Upgrade immediately to mitigate the risk.
Upgrade Showdoc to version 2.10.4 or later. As a temporary workaround, restrict file uploads and use a WAF.
Public PoCs exist, suggesting a moderate risk of active exploitation. Attackers may be targeting vulnerable installations.
Refer to the Showdoc project's release notes and security advisories on their GitHub repository for details.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.