CVE-2022-23059

2022-03-2911:15:07

Google

osv.dev

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.4%

JSON

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

CPENameOperatorVersion
shopizereq2.16.0
shopizereq2.14.0
shopizereq2.13.0
shopizereq2.17.0
shopizereq2.14.1
shopizereq2.15.0

Name	Operator	Version
shopizer	eq	2.16.0
shopizer	eq	2.14.0
shopizer	eq	2.13.0
shopizer	eq	2.17.0
shopizer	eq	2.14.1
shopizer	eq	2.15.0

References

github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e

www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23059