CVE-2022-2925: Cross-site Scripting (XSS) - Stored in appwrite/appwrite
Published Sep 9, 2022
·Updated
Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names.
Other sources
Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
Affected Software
2 affected componentsFixes available
composer/appwrite/server-ce<1.0.0-RC1
1.0.0-RC1
Appwrite Appwrite<=0.15.3
Remediation
Event History
Sep 9, 2022
CVE Published
via MITRE·05:25 AM
Data Sourced
via MITRE·05:25 AM
DescriptionSeverityWeakness
Sep 10, 2022
Advisory Published
via GitHub·12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2022-2925?
CVE-2022-2925 has a moderate severity rating due to the potential for stored cross-site scripting vulnerabilities.
2
How do I fix CVE-2022-2925?
To fix CVE-2022-2925, upgrade to version 1.0.0-RC1 or later of Appwrite.
3
What types of input are affected by CVE-2022-2925?
CVE-2022-2925 affects usernames, function names, storage bucket names, and database collection names.
4
Can CVE-2022-2925 lead to data breaches?
Yes, CVE-2022-2925 could potentially lead to data breaches through stored XSS attacks.
5
Is CVE-2022-2925 present in all versions of Appwrite?
CVE-2022-2925 is present in all versions of Appwrite prior to 1.0.0-RC1.