GHSA-3hwx-c6cp-q972

Publify vulnerable to cross site scripting

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-1811

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	publify_core	< 9.2.9	9.2.9

Details

As written in the advisory (Markdown source, shown as plain text).

Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file. Stored XSS may be obtained.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-1811 advisory
https://github.com/publify/publify/commit/0fb6b027fbaf17f6a6551f2148482a03eac12927 web
https://github.com/publify/publify package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/publify_core/CVE-2022-1811.yml web
https://huntr.dev/bounties/4d97f665-c9f1-4c38-b774-692255a7c44c web