CVE-2022-0877: 
PHP vulnerability analysis and mitigation

Cross-site Scripting (XSS) vulnerability was discovered in GitHub repository bookstackapp/bookstack affecting versions prior to v22.02.3. The vulnerability was identified and tracked as CVE-2022-0877, with the record being created on March 7, 2022 (CVE Mitre, NVD).

The vulnerability was identified as a Stored Cross-site Scripting (XSS) issue in the BookStack application. The fix involved updating Content Security Policy (CSP) rules, particularly focusing on frame-src rules and how CSP rules are set. The implementation now uses a single header instead of multiple headers and includes application to HTML export outputs (GitHub Commit).

The vulnerability could potentially allow attackers to execute malicious scripts in the context of other users' browsers, leading to potential data theft, session hijacking, or other malicious actions typical of XSS attacks.

The vulnerability was patched in BookStack version v22.02.3. The fix included implementing stricter Content Security Policy controls and updating how CSP rules are applied across the application. Users are advised to upgrade to version v22.02.3 or later to receive the security fix (GitHub Commit).