Known vulnerabilities in BookStack

Vendor: Dan Brown
Software: BookStack
Software CPE: cpe:2.3:a:dan_brown:bookstack:*:*:*:*:*:*:*:*
Website: https://danb.me/
Total vulnerabilities: 13
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting BookStack BookStack is affected by 13 known vulnerabilities: 1 high, 5 medium, 7 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU67808 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-40690		 CWE-79 Low
No
No
 22.09 03.10.2022 SB2022100326
#VU58470 - Improper Access Control
CVE-2021-4026		 CWE-284 Medium
No
No
 21.11.2 01.12.2021 SB2021120109
#VU57966 - Unrestricted Upload of File with Dangerous Type
 CWE-434 Medium
No
No
 21.10.3 05.11.2021 SB2021110512
#VU57965 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CWE-22 Medium
No
No
 21.10.3 05.11.2021 SB2021110512
#VU57801 - Improper Access Control
CVE-2021-3906		 CWE-284 Medium
No
No
 21.10.1 29.10.2021 SB2021102919
#VU57180 - Permissions, Privileges, and Access Controls
CVE-2021-3874		 CWE-264 Low
No
No
 21.08.5 11.10.2021 SB2021101103
#VU56459 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3768		 CWE-79 Low
No
No
 21.08.2 13.09.2021 SB2021091304
#VU56458 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3767		 CWE-79 Low
No
No
 21.08.2 13.09.2021 SB2021091304
#VU56307 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 21.08.2 06.09.2021 SB2021090601
#VU56238 - Server-Side Request Forgery (SSRF)
CVE-2021-3758		 CWE-918 Medium
No
No
 21.08 01.09.2021 SB2021090114
#VU27914 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-11055		 CWE-79 Low
No
No
 0.29.2 14.05.2020 SB2020051411
#VU30337 - Unrestricted Upload of File with Dangerous Type
CVE-2020-5256		 CWE-434 High
No
No
 0.25.3 09.03.2020 SB2020030917
#VU37711 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-1000462		 CWE-79 Low
No
No
 - 03.01.2018 SB2018010310