CVE-2020-11055: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in BookStack versions greater than or equal to 0.18.0 and less than 0.29.2. The vulnerability was identified and disclosed on May 2, 2020, and was assigned CVE-2020-11055. The vulnerability affected the comment creation functionality in BookStack, a self-hosted platform for organizing and storing information (GitHub Advisory, JVN Advisory).

The vulnerability allowed users with comment creation permissions to directly POST HTML content to the system, which would then be stored in comments and executed when viewed by other users. This created a stored XSS condition where malicious JavaScript code could be injected and executed in other users' browsers. The vulnerability was assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (JVN Advisory).

The vulnerability primarily impacted scenarios where untrusted users were given permission to create comments. When exploited, it allowed attackers to execute arbitrary JavaScript code in the context of other users' browsers who viewed the malicious comments. This could potentially lead to theft of user session data or other malicious actions performed in the context of the victim's browser (GitHub Advisory).

The vulnerability required an attacker to have valid credentials with comment creation permissions in the BookStack system. While this limited the potential attack surface, environments where comment permissions were given to untrusted users were particularly at risk (BookStack Blog).

The vulnerability was patched in BookStack version 0.29.2. After upgrading, administrators must run the command 'php artisan bookstack:regenerate-comment-content' to remove any pre-existing dangerous content. As temporary workarounds, administrators can either disable comments entirely in the system settings or restrict comment creation permissions to trusted users only (GitHub Advisory).