Lucene search

MendCVELIST:CVE-2022-22116

HistoryJan 10, 2022 - 3:26 p.m.

CVE-2022-22116 Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload

2022-01-1015:26:44

CWE-79

Mend

www.cve.org

directus

stored cross-site scripting

xss

svg file upload

vulnerability

media upload

javascript code

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.

CNA Affected

[
  {
    "product": "directus",
    "vendor": "directus",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.4.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10

www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22116