CVE-2022-23065
02.05.2022, 13:15
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the Assets tab. The uploaded file will affect administrators as well as regular users.
| Vendor | Product | Version |
|---|---|---|
| vendure | vendure | 0.1.2 ≤ 𝑥 ≤ 1.5.1 |
| vendure | vendure | 0.1.0:alpha10 |
| vendure | vendure | 0.1.0:alpha11 |
| vendure | vendure | 0.1.0:alpha12 |
| vendure | vendure | 0.1.0:alpha13 |
| vendure | vendure | 0.1.0:alpha14 |
| vendure | vendure | 0.1.0:alpha15 |
| vendure | vendure | 0.1.0:alpha16 |
| vendure | vendure | 0.1.0:alpha18 |
| vendure | vendure | 0.1.0:alpha2 |
| vendure | vendure | 0.1.0:alpha3 |
| vendure | vendure | 0.1.0:alpha4 |
| vendure | vendure | 0.1.0:alpha5 |
| vendure | vendure | 0.1.0:alpha6 |
| vendure | vendure | 0.1.0:alpha7 |
| vendure | vendure | 0.1.0:alpha8 |
| vendure | vendure | 0.1.0:alpha9 |
𝑥
= Vulnerable software versions
References