CVE-2022-22115: sismics docs, XSS

Описание

Оригинално описание

In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.

Засегнати продукти

• sismics docs: v1.5 преди unspecified; unspecified до v1.9

Вид слабост

• CWE-79 XSS

История

Други уязвимости в sismics docs

• 9.6CVE-2022-22114

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-22115
• https://nvd.nist.gov/vuln/detail/CVE-2022-22115
• https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115