CVE-2022-23073: Recipes - Stored XSS in Clipboard
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23073?
CVE-2022-23073 is a high-severity vulnerability due to its potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2022-23073?
To fix CVE-2022-23073, upgrade Tandoor Recipes to version 1.2.6 or later, where the vulnerability is addressed.
What versions of Tandoor Recipes are affected by CVE-2022-23073?
CVE-2022-23073 affects Tandoor Recipes versions 1.0.5 through 1.2.5.
How does CVE-2022-23073 exploit the application?
CVE-2022-23073 exploits the application by allowing attackers to inject malicious JavaScript through the 'Name' parameter when adding a new food item.
What impact does CVE-2022-23073 have on users?
CVE-2022-23073 can lead to unauthorized actions on behalf of users and the theft of sensitive information.