CVE-2022-32172

2022-10-0618:16:03

CWE-79

Mend

web.nvd.nist.gov

zinc

cve-2022-32172

stored cross-site scripting

xss

security vulnerability

credential access

EPSS

Percentile

12.6%

JSON

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Affected configurations

Nvd

Node

zinclabszincRange0.1.9–0.3.1

VendorProductVersionCPE
zinclabszinc*cpe:2.3:a:zinclabs:zinc:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zinclabs	zinc	*	cpe:2.3:a:zinclabs:zinc::::::::

CNA Affected

[
  {
    "vendor": "zinc",
    "product": "zinc",
    "versions": [
      {
        "version": "v0.1.9",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "v0.3.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]