CVE-2024-40626

CVSS V2 None CVSS V3 None
Description
Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Overview
  • CVE ID
  • CVE-2024-40626
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-07-16T17:03:39.883Z
  • Last Modified Date
  • 2024-07-16T18:22:19.680Z
References
Reference URL Reference Tags
https://github.com/outline/outline/security/advisories/GHSA-888c-mvg8-v6wh x_refsource_CONFIRM
History
Created Old Value New Value Data Type Notes
2024-07-17 13:05:07 Added to TrackCVE