PT-2022-13928 · Unknown · Facturascripts

Published 2022-04-28 · Updated 2022-05-06 · CVE-2022-1514

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2022.06

Description The issue allows for stored cross-site scripting attacks via upload plugin functionality in zip format. This can have severe consequences, including the exfiltration of data or the installation of malware on the user's machine. Attackers can also masquerade as authorized users by accessing session cookies, enabling them to perform any action allowed by the user account.

Recommendations For versions prior to 2022.06, update to version 2022.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload plugin functionality in zip format to minimize the risk of exploitation. Avoid using the vulnerable upload functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1514

GHSA-P3W3-4PPM-C3F6

Affected Products

Facturascripts

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1514.json · Exploit
• 🔥 https://huntr.dev/bounties/4ae2a917-843a-4ae4-8197-8425a596761c · Exploit
• https://github.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e · Patch
• https://osv.dev/vulnerability/GHSA-p3w3-4ppm-c3f6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1514 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1514 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts · Note
• https://t.me/cibsecurity/41592 · Telegram Post
• https://t.me/cvenotify/29811 · Telegram Post