Non évaluée
Vendure - XSS via SVG File Upload
CVE-2022-23065
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web whitesourcesoftware.com