CVE-2022-23065

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 02-05-2022 03:15

Last modified: - 10-05-2022 06:34

Total changes: - 2

Description

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets�? tab. The uploaded file will affect administrators as well as regular users.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

Low

Confidentiality

Low

Integrity

Low

Privileges required

Changed

Scope

Required

User interaction

5.4

Base score

2.3

2.7

Exploitability score

Impact score

Verification logic

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha3

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha4

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha5

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha6

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha7

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha8

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha9

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha10

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha11

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha12

vendor=vendure AND product=vendure AND versionEndIncluding=1.5.1 AND versionStartIncluding=0.1.2

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha13

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha14

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha15

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha16

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha18

vendor=vendure AND product=vendure AND version=0.1.0 AND update=alpha2

Reference

Keywords

CVE-2022-23065

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-23065

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures