CVE-2022-1571 | Cross-site scripting - Reflected in Create Subaccount in Git… | CVSS 9.9 CRITICAL

Description

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...

Metadata

CVE ID: CVE-2022-1571
State: PUBLISHED
Assigner: @huntrdev
Reserved: 2022-05-04 00:00 UTC
Published: 2022-05-04 10:20 UTC
Last updated: 2024-08-03 00:10 UTC
Primary CWE: CWE-79
CWE-79 Improper Neutralization of Input During Web Page Gene…
Vendor / Product: neorazorx / neorazorx/facturascripts
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Affected products (1)

Vendor	Product	Platform	Versions
neorazorx	neorazorx/facturascripts	—	unspecified < 2022.07

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

References (2)