PT-2022-21134 · Zinc · Zinc

Published 2022-10-06 · Updated 2024-08-20 · CVE-2022-32171

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zinc versions v0.1.9 through v0.3.1

Description The issue is related to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.

Recommendations For versions v0.1.9 through v0.3.1, consider disabling the delete user functionality until a patch is available to prevent exploitation of the Stored Cross-Site Scripting vulnerability. Restrict access to the delete user function to minimize the risk of credentials being accessed by an attacker. Avoid using the user id field in the delete user functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-32171

GHSA-4FGV-8448-GF82

GO-2023-1895

Affected Products

Zinc

References · 10

• https://github.com/zinclabs/zinc/commit/3376c248bade163430f9347742428f0a82cd322d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-32171 · Security Note
• https://osv.dev/vulnerability/GO-2023-1895 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4fgv-8448-gf82 · Vendor Advisory
• https://github.com/zincsearch/zincsearch/commit/3376c248bade163430f9347742428f0a82cd322d · Note
• https://t.me/cibsecurity/50900 · Telegram Post
• https://github.com/advisories/GHSA-4fgv-8448-gf82 · Note
• https://t.me/cvenotify/37212 · Telegram Post
• https://mend.io/vulnerability-database/CVE-2022-32171 · Note