CVE-2022-23074: Recipes - Stored XSS in Name Parameter
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23074?
CVE-2022-23074 is classified as a low severity vulnerability affecting Tandoor Recipes.
How do I fix CVE-2022-23074?
To fix CVE-2022-23074, update Tandoor Recipes to a version higher than 1.2.5.
What components are affected by CVE-2022-23074?
CVE-2022-23074 affects the ‘Name’ field of Keyword, Food, and Unit components in Tandoor Recipes.
Who can exploit CVE-2022-23074?
A low privileged attacker can exploit CVE-2022-23074 by injecting an XSS payload.
What kind of attack is CVE-2022-23074 associated with?
CVE-2022-23074 is associated with Stored Cross-Site Scripting (XSS) attacks.