Lucene search

[email protected]NVD:CVE-2022-39301

HistoryOct 19, 2022 - 2:15 p.m.

CVE-2022-39301

2022-10-1914:15:09

CWE-434

CWE-80

[email protected]

web.nvd.nist.gov

sra-admin

background rights management

xss vulnerability

1.1.1

1.1.2

storage

theft

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.9%

JSON

sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in “Personal Center” - “Profile Picture Upload” allowing theft of the user’s personal information. This issue has been patched in 1.1.2. There are no known workarounds.

Affected configurations

NVD

Node

sra-admin_projectsra-adminRange≤1.1.1

References

github.com/momofoolish/sra-admin/security/advisories/GHSA-v7r9-qx74-h3v8