CVE-2022-4597 - Shoplazza LifeStyle Create Product v2_products cross site scripting

Back Back to CVE browser

MEDIUM

Shoplazza LifeStyle Create Product v2_products cross site scripting

Published Dec 18, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2_products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216192.

Affected products

Vendor Shoplazza Product LifeStyle Default
n/a
- Version
  1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Shoplazza

LifeStyle

n/a

Version	Status	Constraints
1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-707

CWE-79

Cross-site Scripting (XSS)

References (3)

https://seclists.org/fulldisclosure/2022/Dec/11
Mailing ListThird Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt
ExploitMailing ListThird Party Advisory
https://vuldb.com/?id.216192
Third Party Advisory

Link	Providers	Tags
https://seclists.org/fulldisclosure/2022/Dec/11		Mailing ListThird Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt		ExploitMailing ListThird Party Advisory
https://vuldb.com/?id.216192		Third Party Advisory