Lucene search

GitHub Advisory DatabaseGHSA-J8C7-3JPQ-8985

HistoryJun 10, 2022 - 12:00 a.m.

Cross-site Scripting in FacturaScripts

2022-06-1000:00:55

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

facturascripts

github

patch available

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts. A patch is available on the master branch of the repository in commit 7b4ddb92.

Affected configurations

Vulners

Node

facturascriptsfacturascriptsRange≤2022.08

VendorProductVersionCPE
facturascriptsfacturascripts*cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
facturascripts	facturascripts	*	cpe:2.3:a:facturascripts:facturascripts::::::::

References

github.com/advisories/GHSA-j8c7-3jpq-8985

github.com/neorazorx/facturascripts/commit/7b4ddb9269a230e2dd07c6a8d3211c9a88f4f09f

huntr.dev/bounties/5fa17e9b-c767-46b4-af64-aafb8c2aa521

nvd.nist.gov/vuln/detail/CVE-2022-2016

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for GHSA-J8C7-3JPQ-8985