CVE-2020-8031: 
Linux Debian vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in Open Build Service, identified as CVE-2020-8031. The vulnerability allows remote attackers to store JavaScript code in markdown that is not properly escaped, affecting the confidentiality and integrity of the system. This security issue impacts Open Build Service versions prior to 2.10.8 (SUSE Bugzilla, CVE Mitre).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation vulnerability. It has a CVSS 3.1 base score of 5.4 (Medium), with the following characteristics: Network attack vector, Low attack complexity, Low privileges required, User interaction required, Changed scope, Low confidentiality impact, Low integrity impact, and No availability impact. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (Ubuntu Security).

The vulnerability allows attackers to inject malicious JavaScript code through project comments. When exploited, the attacker can manipulate HTML attributes to create full-screen overlays and execute JavaScript code automatically when users move their mouse over the affected area. This impacts both the confidentiality and integrity of the system (SUSE Bugzilla).

The vulnerability can be exploited by authenticated users who can add comments to projects in the OBS system. The exploit involves injecting malicious markdown markup with specific HTML attributes including style and onmouseover events. The malicious code is executed when users visit the affected project pages (SUSE Bugzilla).

The vulnerability was addressed in Open Build Service version 2.10.8. The fix was implemented to properly handle HTML encoding of user-supplied href values in markdown content. Organizations running affected versions should upgrade to version 2.10.8 or later to mitigate this security risk (SUSE Bugzilla).