CRITICAL
Stored XSS viva .svg file upload in causefx/organizr
Published Apr 13, 2022
9.0
CRITICALCVSS 3.1
EPSS 1.00%
Description
Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<2.1.1810
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Causefx | Causefx/organizr | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24667 Advisory
- https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a x_refsource_MISCPatchThird Party Advisory
- https://huntr.dev/bounties/781b5c2a-bc98-41a0-a276-ea12399e5a25 x_refsource_CONFIRMExploitPatchThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24667 | Advisory | |
| https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a | x_refsource_MISCPatchThird Party Advisory | |
| https://huntr.dev/bounties/781b5c2a-bc98-41a0-a276-ea12399e5a25 | x_refsource_CONFIRMExploitPatchThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner @huntrdev
Published Apr 13, 2022
Updated Aug 3, 2024
Reserved Apr 13, 2022
Link CVE-2022-1345
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2022-24667 Assigner @huntrdev
Published Apr 13, 2022
Updated Aug 3, 2024
Exploited since n/a
Link EUVD-2022-24667