CVE-2020-11055 Medium · 6.3 EPSS 0.8%

Cross-site Scripting in BookStack

BookStackApp · BookStack

Official description · CVE.org

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.

Breakdown

15.6 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules
What can follow
- Take over a user’s browser sessionT1185 · Browser Session HijackingSource data2 general detection rules

Disclosed on 7 May 2020. No public exploit code or confirmed exploitation is recorded.

techniques

2 , grouped by in kill-chain order 2

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the CVE · primary impact

CollectionTA0009

Browser Session Hijacking T1185

MITRE CTID mapping of the CVE · follow-on activity

Detection

0 rules for this CVE · 97 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-11055 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Browser Session HijackingT11852 general rules

Potential Data Stealing Via Chromium Headless Debugginghightest
Browser Started with Remote Debuggingmediumtest

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: ssddanbrown/bookstack.

Packagistssddanbrown/bookstackGHSA-5vf7-q87h-pg6w

Upgrade to 0.29.2 or later

Set the version to 0.29.2 or later in your composer.json.

The first fix for CVE-2020-11055. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you run	Upgrade to
0.18.0 up to 0.29.2	0.29.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0413

No public exploit code found.

, 30 Oct 2026

0.8%Top 44%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 56%).

3.1

6.3Medium · 6.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.5596 11.2/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 6.3 4.4/7

End-of-life productsupported or unknown 0.0

Total15.6

Record

Published: 7 May 2020
Modified: 4 Aug 2024
: CWE-79 Improper Neutralization of Input During Web Page Generation
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1What they do

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

CollectionTA0009

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_CONFIRM 1

x_refsource_MISC 2

third-party-advisory 1

What they do

What can follow

techniques