CVE-2022-23060: Shopizer - Stored XSS in Manage Files
Published May 1, 2022
·Updated
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab
Affected Software
1 affected component
Shopizer Shopizer>=2.0<=2.17.0
Remediation
Information
Upgrade version to 3.0.0 or higher
Event History
May 1, 2022
CVE Published
via MITRE·12:40 PM
Data Sourced
via MITRE·12:40 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-23060?
CVE-2022-23060 is classified as a high severity vulnerability due to the potential impact of stored cross-site scripting.
2
How do I fix CVE-2022-23060?
To fix CVE-2022-23060, upgrade Shopizer to a version higher than 2.17.0.
3
Who is affected by CVE-2022-23060?
CVE-2022-23060 affects users of Shopizer versions 2.0 through 2.17.0.
4
What type of vulnerability is CVE-2022-23060?
CVE-2022-23060 is categorized as a Stored Cross Site Scripting (XSS) vulnerability.
5
How can attackers exploit CVE-2022-23060?
Attackers can exploit CVE-2022-23060 by injecting malicious JavaScript code into the filename while managing files in Shopizer.