GHSA-p2j7-6g9h-32xh

Cross site scripting in Shopizer

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23059

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.shopizer:shopizer	>= 2.0.2, < 3.0.0	3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23059 advisory
https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e web
https://github.com/shopizer-ecommerce/shopizer package
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23059 web