Description
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.
Published:
2022-10-06
Score:
n/a
EPSS:
< 1% Very Low
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| zinc | zinc | affected |
|
No data.
No data available yet.
Remediation
Vendor Solution
Update version to v0.3.2 or later
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1990 | In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials. |
 Github GHSA |
GHSA-7j6x-42mm-p7jm | Zinc Cross-site Scripting vulnerability |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Mend
Published:
Updated: 2024-09-16T22:02:26.570Z
Reserved: 2022-05-31T00:00:00.000Z
Link: CVE-2022-32172
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-10-06T18:16:03.630
Modified: 2024-11-21T07:05:52.753
Link: CVE-2022-32172
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses