PT-2022-13815 · Causefx · Organizr

Published 2022-04-13 · Updated 2022-07-25 · CVE-2022-1345

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions causefx/organizr versions prior to 2.1.1810

Description The issue allows attackers to execute malicious scripts in the user's browser through stored XSS via .svg file upload. This can lead to session hijacking, sensitive data exposure, and other severe consequences.

Recommendations For versions prior to 2.1.1810, update to version 2.1.1810 or later to resolve the issue. As a temporary workaround, consider restricting the upload of .svg files to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-1345

Affected Products

Organizr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1345.json · Exploit
• 🔥 https://huntr.dev/bounties/781b5c2a-bc98-41a0-a276-ea12399e5a25 · Exploit
• https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1345 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1345 · Vendor Advisory
• https://t.me/cvenotify/28895 · Telegram Post