What is GHSA-5j94-f3mf-8685?

GHSA-5j94-f3mf-8685 is a security advisory published by GitHub Security Advisories with Medium severity. @backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

Which CVE IDs does GHSA-5j94-f3mf-8685 cover?

GHSA-5j94-f3mf-8685 covers the following CVE IDs: CVE-2024-46976. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5j94-f3mf-8685?

GHSA-5j94-f3mf-8685 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5j94-f3mf-8685?

GHSA-5j94-f3mf-8685 affects 1 product, including: npm/@backstage/plugin-techdocs-backend:\u003c 1.10.13.

GHSA-5j94-f3mf-8685MediumCVSS 6.5

@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

Vendor

GitHub Security Advisories

Published

September 17, 2024

Last Modified

September 17, 2024

🔗 CVE IDs covered (1)

CVE-2024-46976 →

📋 Description

Impact

An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link.

Patches

This has been fixed in the 1.10.13 release of the @backstage/plugin-techdocs-backend package.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

🎯 Affected products1

npm/@backstage/plugin-techdocs-backend:< 1.10.13

🔗 References (3)

https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685
https://nvd.nist.gov/vuln/detail/CVE-2024-46976
https://github.com/advisories/GHSA-5j94-f3mf-8685