Detections
Analytics
SCA: security update for ssddanbrown/bookstack (GHSA-ch37-ch8w-cfrq)
high Tenable Self-Hosted Container Security Plugin ID 431906
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code
through the use of `javascript:` URIs within a link or form which would run, within the context of the
current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert
a particular meta tag which could be used to silently redirect users to a alternative location upon visit
of a page. Dangerous content may remain in the database but will be removed before being displayed on a
page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a
workaround without upgrading, page edit permissions could be limited to only those that are trusted until
you can upgrade although this will not address existing exploitation of this vulnerability. The issue is
fixed in BookStack version 0.30.4. (CVE-2020-26211)
See Also
Plugin Details
Severity: High
ID: 431906
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 8/7/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.8
Percentile: 56.9
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Low
Base Score: 3.5
Temporal Score: 2.6
Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2020-26211
CVSS v3
Risk Factor: High
Base Score: 8.7
Temporal Score: 7.6
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/24/2022
Vulnerability Publication Date: 11/3/2020
Reference Information
CVE: CVE-2020-26211
cwe: CWE-79