CVE-2022-23073

Katalog CVE

CVSS 3.5 · Low EPSS 0,85%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada tandoor recipes. Skor CVSS 2.0 3.5 (Low) menurut NVD.

Deskripsi (NVD)

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

Rincian

Terbit di NVD

21 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 2.0

3.5 (Low), sumber NVD
AV:N/AC:M/Au:S/C:N/I:P/A:N

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 patch · advisory pihak ketiga
• https://www.mend.io/vulnerability-database/CVE-2022-23073 exploit · advisory pihak ketiga