Main Vulnerability Database Vulnerabilities #VU31289

Cross-site scripting in GitBook - CVE-2017-16019

Published: June 4, 2018 / Updated: July 17, 2020

Vulnerability identifier: #VU31289

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2017-16019

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.

Affected software

GitBook

How to mitigate CVE-2017-16019

Install update from vendor's website.

GitBook - update to 3.2.2

External References

Related Security Bulletins