CVE-2022-1571 Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts

2022-05-0410:20:09

CWE-79

@huntrdev

www.cve.org

cross-site scripting

reflected

neorazorx/facturascripts

github

vulnerability

javascript

http request

security

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

EPSS

0.001

Percentile

30.0%

JSON

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user’cookie, perform HTTP request, get content of same origin page, etc …

CNA Affected

[
  {
    "product": "neorazorx/facturascripts",
    "vendor": "neorazorx",
    "versions": [
      {
        "lessThan": "2022.07",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]