CVE-2020-29456 Cross-site scripting in papermerge
Remote attackers can inject arbitrary scripts via filenames or tags, potentially executing code without authentication if email consumption is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-29456?
CVE-2020-29456 is a medium-severity cross-site scripting vulnerability in n/a, published on 2 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
Weakness: CWE-79
Which versions are affected by CVE-2020-29456?
3 open source packages ship an affected version, including papermerge. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
papermerge PyPI | From 1.2.0 | 1.5.2 |
papermerge PyPI | From 1.2.0 | 1.5.2 |
papermerge PyPI | From 1.2.0 | 1.5.2 |
Products include Papermerge Papermerge.
How do I fix CVE-2020-29456?
Upgrade papermerge to 1.5.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-29456 being exploited?
There is no known exploitation of CVE-2020-29456 in the wild and no public exploit code.
Sources
Also known as GHSA-9w49-m7xh-5r39, PYSEC-2020-74.