In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
References:GSA_kwCzR0hTQS0zaDd2LXdxdzctZmYyOM4AArCV
Cross site scripting in publify
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
rubygems:publify_core
PURL:
pkg:gem/publify_core
|
>= 8.0, < 9.2.5 | 9.2.5 | |
Affected Version RangesAll affected versions9.0.0, 9.0.1, 9.1.0, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4 All unaffected versions9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10, 10.0.0, 10.0.1, 10.0.2, 10.0.3 |
|||