CVE-2022-23072: Recipes - Stored XSS in Add to Cart
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23072?
The severity of CVE-2022-23072 is critical due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2022-23072?
To fix CVE-2022-23072, upgrade Tandoor Recipes to version 1.2.6 or later, which addresses the vulnerability.
Who is affected by CVE-2022-23072?
CVE-2022-23072 affects users of Tandoor Recipes versions 1.0.5 through 1.2.5 that utilize the Add to Cart functionality.
What type of attack is associated with CVE-2022-23072?
CVE-2022-23072 is associated with stored cross-site scripting (XSS) attacks, where malicious scripts can be injected.
What is the exploit vector for CVE-2022-23072?
The exploit vector for CVE-2022-23072 involves injecting a malicious JavaScript payload through the 'Name' parameter when adding a new food item.