CVE-2022-1571

Published: May 4, 2022

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.0

9.9

CRITICAL

Description

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...

Vendor	Product	Versions
neorazorx	neorazorx/facturascripts	affected `unspecified - < 2022.07`

Weaknesses (CWE)

CWE-79

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

References

https://huntr.dev/bounties/4578a690-73e5-4313-840c-ee15e5329741

x_refsource_CONFIRM

https://github.com/neorazorx/facturascripts/commit/482c5a82b4d79e7a19614f5a67dc24593046cefd

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2022-1571

Description

Affected Products

Weaknesses (CWE)

CVSS v3.0 Details

References