CVE-2022-41706
Browsershot 3.57.2 - Server Side XSS to LFR via URL
概要
Browsershot 3.57.2 - Server Side XSS to LFR via URL
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory fluidattacks.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web packagist.org