CVE-2022-23065: Vendure - XSS via SVG File Upload
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23065?
CVE-2022-23065 is classified as a Stored XSS vulnerability affecting specific versions of Vendure.
How do I fix CVE-2022-23065?
To fix CVE-2022-23065, upgrade Vendure to version 1.5.2 or later, which addresses the XSS vulnerability.
Who is affected by CVE-2022-23065?
Administrators and users with catalog permissions are affected by CVE-2022-23065 due to the potential for uploading malicious SVG files.
What versions are impacted by CVE-2022-23065?
CVE-2022-23065 affects Vendure versions 0.1.0-alpha.2 to 1.5.1.
What type of attack is possible with CVE-2022-23065?
CVE-2022-23065 allows attackers to execute malicious JavaScript through a Stored XSS attack via SVG file uploads.