CVE-2022-22116

2022-01-1016:15:10

Google

osv.dev

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.5%

JSON

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.

CPENameOperatorVersion
directuseq9.2.1
directuseq9.2.2
directuseq9.0.1
directuseq9.4.1
directuseq9.1.1
directuseq9.3.0
directuseq9.2.0
directuseq9.4.0
directuseq9.1.0
directuseq9.1.2

Name	Operator	Version
directus	eq	9.2.1
directus	eq	9.2.2
directus	eq	9.0.1
directus	eq	9.4.1
directus	eq	9.1.1
directus	eq	9.3.0
directus	eq	9.2.0
directus	eq	9.4.0
directus	eq	9.1.0
directus	eq	9.1.2