未評価
Vendure - XSS via SVG File Upload
CVE-2022-23065
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web whitesourcesoftware.com