Lucene search
GoogleOSV:CVE-2022-22124HistoryJan 13, 2022 - 5:15 p.m.
CVE-2022-22124
2022-01-1317:15:07
Google
osv.dev
5
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
| CPE | Name | Operator | Version |
|---|---|---|---|
| halo | eq | 1.4.0-beta.1 | |
| halo | eq | 2.3.1 | |
| halo | eq | 1.0.2-beta.1 | |
| halo | eq | 1.1.3-beta.1 | |
| halo | eq | 2.0.2 | |
| halo | eq | 1.4.3-beta.3 | |
| halo | eq | 2.0.3 | |
| halo | eq | 1.4.0 | |
| halo | eq | 1.4.1 | |
| halo | eq | 1.3.0 |
Related
cvelist
cvelist
CVE-2022-22124 Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
2022-01-11 00:00:00
nvd
nvd
CVE-2022-22124
2022-01-13 17:15:07
cve
cve
CVE-2022-22124
2022-01-13 17:15:07
prion
prion
Cross site scripting
2022-01-13 17:15:00
cnvd
cnvd
Halo Cross-Site Scripting Vulnerability (CNVD-2022-08205)
2022-01-17 00:00:00