GHSA-9652-78hp-w58c

Stored cross-site scripting in PressBooks

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3271

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pressbooks/pressbooks	< 5.18.0	5.18.0

Details

As written in the advisory (Markdown source, shown as plain text).

PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3271 advisory
https://github.com/pressbooks/pressbooks/pull/2072 web
https://github.com/pressbooks/pressbooks/commit/941a8c5eaeacea5eb211b54ee55bc0348139cbd8 web
https://github.com/pressbooks/pressbooks web
https://www.gosecure.net/blog/2021/02/16/cve-2021-3271-pressbooks-stored-cross-site-scripting-proof-of-concept web