CVE-2024-46976

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-693 CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 17, 2024
Last modified: Jun 17, 2026
NVD status: Undergoing Analysis

Related CVEs from 2024

CVE-2024-469776.5OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vul CVE-2024-469786.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing CVE-2024-469795.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to noti CVE-2024-46986.4The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slid CVE-2024-469804.8Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap E CVE-2024-469819.8Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulat CVE-2024-469827.5Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache CVE-2024-469839.8sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechani CVE-2024-469849.8The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The p CVE-2024-469857.5DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerabilit CVE-2024-469869.9Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible vi CVE-2024-469877.7Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via Media