CVE-2022-23059: Shopizer - Stored XSS in Manage Images
Published Mar 29, 2022
·Updated
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Affected Software
1 affected component
Shopizer Shopizer>=2.0<=2.17.0
Remediation
Information
Update version to 3.0.0
Event History
Mar 29, 2022
CVE Published
via MITRE·10:25 AM
Data Sourced
via MITRE·10:25 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-23059?
CVE-2022-23059 has a medium severity level due to its potential for exploitation via stored XSS attacks.
2
How do I fix CVE-2022-23059?
To fix CVE-2022-23059, upgrade Shopizer to version 2.18.0 or later, which addresses this vulnerability.
3
What versions of Shopizer are affected by CVE-2022-23059?
CVE-2022-23059 affects Shopizer versions 2.0 through 2.17.0.
4
What type of attack does CVE-2022-23059 enable?
CVE-2022-23059 enables a stored Cross Site Scripting (XSS) attack via the upload of SVG files.
5
Can CVE-2022-23059 affect user data?
Yes, CVE-2022-23059 can compromise user data by allowing attackers to execute malicious scripts on user sessions.