-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability (GHSA-59x8-cvxh-3mm4) is a stored XSS in the comments feature of YesWiki, caused by improper sanitization of JavaScript block comments (/* ... */). The provided commit (0d4efc880a727599fa4f6d7a64cc967afe475530) is listed as the patch for this vulnerability. While the direct changes in this commit are related to ACL configurations for various API endpoints (including those for comments), the functions ApiController::postComment and ApiController::editComment are identified as vulnerable. These functions are the primary entry points for creating and updating comments, respectively. As per the vulnerability description, they process user-supplied comment data that is not adequately sanitized, allowing malicious JavaScript payloads (obfuscated with block comments) to be stored and later executed in users' browsers. The modifications to these functions in the security-related commit, even if for ACLs, confirm their role in the comment handling system that contains the XSS flaw. The vulnerability lies in the system's failure to sanitize the data these functions handle, making them processors of potentially malicious input.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yeswiki/yeswiki | composer | <= 4.5.3 | 4.5.4 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report