CVE-2020-8031 obs: Stored XSS

What is CVE-2020-8031?

CVE-2020-8031 is a medium-severity cross-site scripting vulnerability in openSUSE Open Build Service, published on 11 Feb 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prior to 2.10.8.

Weakness: CWE-79

Which versions are affected by CVE-2020-8031?

It affects 1 product.

Products include Opensuse Open Build Service.

How do I fix CVE-2020-8031?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-8031 being exploited?

There is no known exploitation of CVE-2020-8031 in the wild and no public exploit code.

Other vulnerabilities in openSUSE Open Build Service

• CVE-2022-21949 Multiple XXE vulnerabilities in OBS High 8.8
• CVE-2013-3703 No write permission check in change_role command High 8.8
• CVE-2014-0594 CSRF protection incorrectly disabled High 8.8
• CVE-2021-36777 login-proxy sends password to attacker-provided domain High 8.1
• CVE-2011-3178 openbuildservice webui code injection High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-8031, GHSA-6g6q-c7q8-8r7m, OESA-2022-1577, UBUNTU-CVE-2020-8031.