PT-2022-15819 · Shopizer · Shopizer

Published 2022-03-29 · Updated 2022-04-08 · CVE-2022-23059

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopizer versions 2.0 through 2.17.0

Description A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

Recommendations For versions 2.0 through 2.17.0, consider disabling the image upload functionality in the "Manage Images" tab until a patch is available to prevent exploitation of the Stored Cross Site Scripting (XSS) vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23059

GHSA-P2J7-6G9H-32XH

Affected Products

Shopizer

References · 7

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2022-23059 · Exploit
• https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e · Patch
• https://osv.dev/vulnerability/GHSA-p2j7-6g9h-32xh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23059 · Security Note
• https://github.com/shopizer-ecommerce/shopizer · Note
• https://t.me/cibsecurity/39718 · Telegram Post