CVE-2022-1514: Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-1514?
CVE-2022-1514 is a vulnerability that allows for stored cross-site scripting (XSS) attacks via the upload plugin functionality in zip format in the GitHub repository neorazorx/facturascripts prior to version 2022.06.
What are the potential consequences of a stored XSS attack?
Stored XSS attacks can result in data exfiltration or the installation of malware on a user's machine.
How severe is CVE-2022-1514?
CVE-2022-1514 has a severity level of critical with a CVSS score of 5.4.
How can I fix the vulnerability in GitHub repository neorazorx/facturascripts?
To fix the vulnerability, update the GitHub repository neorazorx/facturascripts to version 2022.06 or above.
Where can I find more information about CVE-2022-1514?
More information about CVE-2022-1514 can be found at the following references: https://github.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e, https://huntr.dev/bounties/4ae2a917-843a-4ae4-8197-8425a596761c