未評価
Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
CVE-2022-22124
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web github.com
- web whitesourcesoftware.com