Lucene search

MendCVE-2022-23059

HistoryMar 29, 2022 - 11:15 a.m.

CVE-2022-23059

2022-03-2911:15:07

CWE-79

Mend

web.nvd.nist.gov

cve

2022

23059

stored xss

shopizer

security vulnerability

manage images

svg

javascript

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

Affected configurations

Nvd

Node

shopizershopizerRange2.0–2.17.0

VendorProductVersionCPE
shopizershopizer*cpe:2.3:a:shopizer:shopizer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shopizer	shopizer	*	cpe:2.3:a:shopizer:shopizer::::::::

CNA Affected

[
  {
    "product": "Shopizer",
    "vendor": "shopizer-ecommerce",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.17.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e

www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23059

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2022-23059