CVE-2022-32172 Zinc - Cross-Site Scripting

2022-10-0617:13:36

CWE-79

Mend

www.cve.org

zinc application

v0.1.9

v0.3.1

stored cross-site scripting

delete template

authenticated user

xss payload

javascript payload

user's credentials

AI Score

5.3

Confidence

High

EPSS

Percentile

12.6%

JSON

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

CNA Affected

[
  {
    "vendor": "zinc",
    "product": "zinc",
    "versions": [
      {
        "version": "v0.1.9",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "v0.3.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]