GHSA-8wp2-vxpg-xcvp

Source

https://github.com/advisories/GHSA-8wp2-vxpg-xcvp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-8wp2-vxpg-xcvp/GHSA-8wp2-vxpg-xcvp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8wp2-vxpg-xcvp

Aliases

CVE-2022-1457

Published

2022-04-26T00:00:43Z

Modified

2023-11-08T04:07:49.177817Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Cross site scripting in facturascripts

Details

facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.

Database specific

{
    "nvd_published_at": "2022-04-25T10:15:00Z",
    "github_reviewed_at": "2022-04-27T20:20:50Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Packagist / neorazorx/facturascripts

Package

Name: neorazorx/facturascripts
Purl: pkg:composer/neorazorx/facturascripts

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2022.04