Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2023-25571

MEDIUM
Published 2023-02-14T17:00:19.154Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-25571. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
6.8
/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.003
probability
of exploitation in the wild

There is a 0.3% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.563
Higher than 56.3% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Description

Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack.

This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` version 1.2.0 and greater will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition, the catalog model v0.12.4 and greater as well as the catalog backend v1.7.2 and greater now has additional validation built in that prevents `javascript:` URLs in known annotations. As a workaround, the general practice of limiting access to modifying catalog content and requiring code reviews greatly help mitigate this vulnerability.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

backstage

backstage

Affected Versions:

< 1.2.0 < 0.12.4 < 1.7.2

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Cross site scripting Vulnerability in backstage Software Catalog

GHSA-7hv8-3fr9-j2hv

Advisory Details

### Impact This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack. ### Patches This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition the catalog model as well as the catalog backend now has additional validation built in that prevents `javascript:` URLs in known annotations. ### Workarounds The general practice of limiting access to modifying catalog content and requiring code reviews greatly helps mitigate this vulnerability. ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in the [Backstage README](https://github.com/backstage/backstage)

Affected Packages

npm @backstage/core-components
ECOSYSTEM: ≥0 <0.12.4
npm @backstage/catalog-model
ECOSYSTEM: ≥0 <1.2.0
npm @backstage/plugin-catalog-backend
ECOSYSTEM: ≥0 <1.7.2

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

References

WEB https://github.com/backstage/backstage/security/advisories/GHSA-7hv8-3fr9-j2hv
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-25571
WEB https://github.com/backstage/backstage/commit/3d1371954512f7fa8bd0e2d357e00eada2c3e8a8
PACKAGE https://github.com/backstage/backstage

Advisory provided by GitHub Security Advisory Database. Published: February 14, 2023, Modified: February 14, 2023

References

https://github.com/backstage/backstage/security/advisories/GHSA-7hv8-3fr9-j2hv
https://github.com/backstage/backstage/commit/3d1371954512f7fa8bd0e2d357e00eada2c3e8a8
Published: 2023-02-14T17:00:19.154Z
Last Modified: 2025-03-10T21:12:13.788Z
Copied to clipboard!