CVE-2022-22124: Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-22124?
CVE-2022-22124 is a vulnerability in Fit2cloud Halo versions v1.0.0 to v1.4.17 that allows an authenticated attacker to upload a malicious SVG file and trigger arbitrary JavaScript execution on a victim's browser.
How severe is CVE-2022-22124?
CVE-2022-22124 has a severity score of 5.4, which is considered medium.
Which software versions are affected by CVE-2022-22124?
Fit2cloud Halo versions v1.0.0 to v1.4.17 are affected by CVE-2022-22124.
How can an attacker exploit CVE-2022-22124?
An authenticated attacker can exploit CVE-2022-22124 by uploading a carefully crafted SVG file as a profile image, which will trigger the execution of arbitrary JavaScript on a victim's browser.
Are there any references for CVE-2022-22124?
Yes, you can find more information about CVE-2022-22124 at the following references: [GitHub](https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/handler/file/FileHandler.java#L30), [GitHub Issues](https://github.com/halo-dev/halo/issues/1575), [WhiteSource Software](https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22124).