CVE-2022-34009: XSS

Published Jul 27, 2022

Updated

Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as malware.

Affected Software

2 affected components

Fossil-scm Fossil=2.18

Microsoft Windows

Event History

Jul 27, 2022

CVE Published

via MITRE·11:23 PM

Data Sourced

via MITRE·11:23 PM

Description

Frequently Asked Questions

What is the severity of CVE-2022-34009?

CVE-2022-34009 has been classified as a denial of service vulnerability that can result in a daemon crash.

How do I fix CVE-2022-34009?

To mitigate CVE-2022-34009, ensure you are using an updated version of Fossil that addresses this vulnerability.

What versions of Fossil are affected by CVE-2022-34009?

Fossil version 2.18 is specifically affected by CVE-2022-34009.

Can CVE-2022-34009 affect system stability?

Yes, CVE-2022-34009 can lead to system instability by causing the daemon to crash.

What conditions allow CVE-2022-34009 to be exploited?

CVE-2022-34009 can be exploited when the ticket data processed contains an XSS payload and when the temporary file is improperly handled.