CVE-2022-23074 Recipes - Stored XSS in Name Parameter

2022-06-2109:20:10

CWE-79

Mend

www.cve.org

cve-2022-23074

stored cross-site scripting

recipes application

name parameter

api key theft

admin account takeover

AI Score

5.3

Confidence

High

EPSS

Percentile

12.8%

JSON

In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim’s API key and can lead to admin’s account takeover.

CNA Affected

[
  {
    "product": "recipes",
    "vendor": "recipes",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.17.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "1.2.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]