PT-2022-15819

CVE-2022-23059

·

Published

2022-03-29

·

Updated

2022-04-08

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Shopizer versions 2.0 through 2.17.0
Description A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Recommendations For versions 2.0 through 2.17.0, consider disabling the image upload functionality in the "Manage Images" tab until a patch is available to prevent exploitation of the Stored Cross Site Scripting (XSS) vulnerability.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2022-23059
GHSA-P2J7-6G9H-32XH
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com