CVE-2020-5223 Persistent XSS vulnerability in filename of attached file in PrivateBin
Persistent XSS in PrivateBin allows attackers to inject HTML via attachment filenames, potentially executing scripts in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5223?
CVE-2020-5223 is a medium-severity cross-site scripting vulnerability in PrivateBin, published on 23 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
Weakness: CWE-79
Which versions are affected by CVE-2020-5223?
4 open source packages ship an affected version, including privatebin/privatebin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
privatebin/privatebin Packagist | All versions | 1.2.2 |
privatebin/privatebin Packagist | All versions | 1.2.2 |
privatebin/privatebin Packagist | From 1.3.0 | 1.3.2 |
privatebin/privatebin Packagist | From 1.3.0 | 1.3.2 |
Products include Privatebin Privatebin.
How do I fix CVE-2020-5223?
Upgrade privatebin/privatebin to a fixed version for your release line: 1.2.2 or 1.3.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-5223 being exploited?
There is no known exploitation of CVE-2020-5223 in the wild and no public exploit code.
Other vulnerabilities in PrivateBin
Sources
Also known as GHSA-8j72-p2wm-6738.