Stored Cross-Site Scripting (XSS) Vulnerability in csaf_provider
view advisory published 2022-11-04
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-43996US | medium5.4 | — | ||
The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded w… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- Mitigation
Ensure that no CSAF advisories containing JavaScript code are uploaded, e.g. by organizational measures.
- Fixed
Update to the latest version, at least version 0.8.2.
https://github.com/csaf-poc/csaf_distribution/releases/latest
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan