CVE-2020-15274 - CVE House
Back to Database
Status published Medium CVE-2020-15274

Stored XSS via search result in Wiki.js

Vulnerability Description

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15274

Credits & Attribution

No credits recorded in the NVD database.

References

More from Requarks

View All →
CVE-2022-23654
Improper write access check in Requarks/wiki
High 8.1
CVE-2021-43856
Stored XSS in non-image uploads in Requarks/wiki
High 8.2
CVE-2021-43855
Stored XSS via SVG in Requarks/wiki
High 8.2
CVE-2021-43842
Stored XSS via SVG file upload in Wiki.js
Medium 5.4
CVE-2021-43800
Asset directory traversal with some storage modules on Windows
High 7.5

Affected Vendor

Affected Software

wiki.js
Vulnerable Versions:
< 2.5.162

Timeline

Official Publish: October 26th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact