CVE-2022-22117

2022-01-1016:15:10

Google

osv.dev

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.5%

JSON

In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.

CPENameOperatorVersion
directuseq9.2.1
directuseq9.2.2
directuseq9.0.1
directuseq9.4.1
directuseq9.1.1
directuseq9.3.0
directuseq9.2.0
directuseq9.4.0
directuseq9.1.0
directuseq9.1.2

Name	Operator	Version
directus	eq	9.2.1
directus	eq	9.2.2
directus	eq	9.0.1
directus	eq	9.4.1
directus	eq	9.1.1
directus	eq	9.3.0
directus	eq	9.2.0
directus	eq	9.4.0
directus	eq	9.1.0
directus	eq	9.1.2