Information disclosure in backstage/plugin-techdocs - CVE-2021-32661

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the object element script injection flaw. A remote attacker can trick a victim to visit a specially crafted documentation page and gain unauthorized access to sensitive information on the system.

Affected software

How to mitigate CVE-2021-32661

External References

• https://github.com/backstage/backstage/security/advisories/GHSA-gg96-f8wr-p89f
• https://github.com/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c
• https://github.com/backstage/backstage/releases/tag/release-2021-06-03

Related Security Bulletins

• Information disclosure in backstage/plugin-techdocs package for npm