CVE-2022-32171 Zinc - Stored XSS

2022-10-0617:14:15

CWE-79

Mend

www.cve.org

zinc

cross-site scripting

delete user

credentials

AI Score

5.3

Confidence

High

EPSS

Percentile

12.6%

JSON

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.

CNA Affected

[
  {
    "vendor": "zinc",
    "product": "zinc",
    "versions": [
      {
        "version": "v0.1.9",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "v0.3.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]