Cross-site Scripting in showdoc/showdoc
The advisory, in context
ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.10.4
Fixed in 2.10.4
137 explicitly affected versions
v1.0.0, v1.0.1, v1.0.2, v1.0.3, v1.0.4, v1.0.5, v1.1.0, v1.1.1, v1.1.3, v1.1.4, v1.1.5, v1.2.0, v1.2.1, v1.2.2, v1.2.3, v1.2.4, v1.2.5, v1.2.6, v1.3.0, v1.3.1, v1.3.3, v1.3.4, v1.3.5, v1.3.6, v1.3.7, v1.3.8, v1.4.0, v1.4.1, v1.4.2, v1.4.3, v1.4.4, v1.4.5, v1.4.6, v1.4.7, v1.5.0, v1.5.1, v1.5.2, v1.5.3, v1.6.0, v1.6.1, v1.6.2, v1.7.0, v1.7.1, v1.7.2, v1.8.0, v1.8.1, v1.8.2, v1.8.3, v1.8.4, v1.8.5, v1.8.6, v2.0, v2.0.1, v2.0.10, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.0.7, v2.0.8, v2.0.9, v2.1.0, v2.1.1, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.10.0, v2.10.1, v2.10.2, v2.10.3, v2.2.0, v2.2.1, v2.3.0, v2.3.1, v2.3.3, v2.4.0, v2.4.1, v2.4.10, v2.4.11, v2.4.12, v2.4.13, v2.4.15, v2.4.16, v2.4.17, v2.4.2, v2.4.3, v2.4.5, v2.4.6, v2.4.7, v2.4.8, v2.4.9, v2.5.1, v2.5.2, v2.5.3, v2.5.5, v2.6.1, v2.6.2, v2.6.3, v2.6.5, v2.6.6, v2.6.7, v2.7.0, v2.7.1, v2.8.0, v2.8.1, v2.8.10, v2.8.11, v2.8.12, v2.8.13, v2.8.14, v2.8.15, v2.8.16, v2.8.2, v2.8.3, v2.8.5, v2.8.6, v2.8.7, v2.8.8, v2.8.9, v2.9.0, v2.9.1, v2.9.10, v2.9.11, v2.9.12, v2.9.13, v2.9.14, v2.9.15, v2.9.2, v2.9.3, v2.9.4, v2.9.5, v2.9.6, v2.9.7, v2.9.8, v2.9.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.0",
"v1.0.1",
"v1.0.2",
"v1.0.3",
"v1.0.4",
"v1.0.5",
"v1.1.0",
"v1.1.1",
"v1.1.3",
"v1.1.4",
"v1.1.5",
"v1.2.0",
"v1.2.1",
"v1.2.2",
"v1.2.3",
"v1.2.4",
"v1.2.5",
"v1.2.6",
"v1.3.0",
"v1.3.1",
"v1.3.3",
"v1.3.4",
"v1.3.5",
"v1.3.6",
"v1.3.7",
"v1.3.8",
"v1.4.0",
"v1.4.1",
"v1.4.2",
"v1.4.3",
"v1.4.4",
"v1.4.5",
"v1.4.6",
"v1.4.7",
"v1.5.0",
"v1.5.1",
"v1.5.2",
"v1.5.3",
"v1.6.0",
"v1.6.1",
"v1.6.2",
"v1.7.0",
"v1.7.1",
"v1.7.2",
"v1.8.0",
"v1.8.1",
"v1.8.2",
"v1.8.3",
"v1.8.4",
"v1.8.5",
"v1.8.6",
"v2.0",
"v2.0.1",
"v2.0.10",
"v2.0.2",
"v2.0.3",
"v2.0.4",
"v2.0.5",
"v2.0.6",
"v2.0.7",
"v2.0.8",
"v2.0.9",
"v2.1.0",
"v2.1.1",
"v2.1.2",
"v2.1.3",
"v2.1.4",
"v2.1.5",
"v2.10.0",
"v2.10.1",
"v2.10.2",
"v2.10.3",
"v2.2.0",
"v2.2.1",
"v2.3.0",
"v2.3.1",
"v2.3.3",
"v2.4.0",
"v2.4.1",
"v2.4.10",
"v2.4.11",
"v2.4.12",
"v2.4.13",
"v2.4.15",
"v2.4.16",
"v2.4.17",
"v2.4.2",
"v2.4.3",
"v2.4.5",
"v2.4.6",
"v2.4.7",
"v2.4.8",
"v2.4.9",
"v2.5.1",
"v2.5.2",
"v2.5.3",
"v2.5.5",
"v2.6.1",
"v2.6.2",
"v2.6.3",
"v2.6.5",
"v2.6.6",
"v2.6.7",
"v2.7.0",
"v2.7.1",
"v2.8.0",
"v2.8.1",
"v2.8.10",
"v2.8.11",
"v2.8.12",
"v2.8.13",
"v2.8.14",
"v2.8.15",
"v2.8.16",
"v2.8.2",
"v2.8.3",
"v2.8.5",
"v2.8.6",
"v2.8.7",
"v2.8.8",
"v2.8.9",
"v2.9.0",
"v2.9.1",
"v2.9.10",
"v2.9.11",
"v2.9.12",
"v2.9.13",
"v2.9.14",
"v2.9.15",
"v2.9.2",
"v2.9.3",
"v2.9.4",
"v2.9.5",
"v2.9.6",
"v2.9.7",
"v2.9.8",
"v2.9.9"
]
}