PT-2022-13970 · Unknown · Facturascripts

Published 2022-05-04 · Updated 2022-05-11 · CVE-2022-1571

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2022.07

Description This issue allows for reflected cross-site scripting attacks, enabling the arbitrary execution of javascript code. This can lead to the theft of users' cookies, performance of HTTP requests, and retrieval of content from pages with the same origin. The vulnerability can be exploited to steal user cookies, perform HTTP requests, and get the content of the same origin page.

Recommendations For versions prior to 2022.07, update to version 2022.07 or later, which includes the fix for this issue. As a temporary workaround, consider restricting access to the Create Subaccount feature in the GitHub repository neorazorx/facturascripts until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1571

GHSA-M8GV-GVHF-7RHP

Affected Products

Facturascripts

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1571.json · Exploit
• 🔥 https://huntr.dev/bounties/4578a690-73e5-4313-840c-ee15e5329741 · Exploit
• https://github.com/neorazorx/facturascripts/commit/482c5a82b4d79e7a19614f5a67dc24593046cefd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1571 · Security Note
• https://osv.dev/vulnerability/GHSA-m8gv-gvhf-7rhp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1571 · Vendor Advisory
• https://github.com/neorazorx/facturascripts · Note
• https://t.me/cvenotify/29661 · Telegram Post
• https://t.me/cibsecurity/41890 · Telegram Post