Unrated
Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
CVE-2022-22124
First seen on SecPulse
Original description The description as published by the source.
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
References
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web github.com
- web whitesourcesoftware.com