Non évaluée
Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
CVE-2022-22124
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
Références
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web github.com
- web whitesourcesoftware.com