Unrated
Vendure - XSS via SVG File Upload
CVE-2022-23065
First seen on SecPulse
Original description The description as published by the source.
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web whitesourcesoftware.com