---

CVE-2020-26297 - log back

CVE-2020-26297 edited at 04 Jan 2021 16:08:52
Severity	- Unknown + Medium
Remote	- Unknown + Remote
Type	- Unknown + Cross-site scripting
Description	+ The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.
References	+ https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0 + https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606
Notes

CVE-2020-26297 created at 04 Jan 2021 16:06:09