PT-2022-21135 · Zinc · Zinc

Published 2022-10-06 · Updated 2024-08-20 · CVE-2022-32172

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zinc versions v0.1.9 through v0.3.1

Description The issue concerns Stored Cross-Site Scripting in Zinc when using the delete template functionality. If an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed, allowing an attacker to access the user’s credentials.

Recommendations For versions v0.1.9 through v0.3.1, consider disabling the delete template functionality until a patch is available to prevent exploitation of the Stored Cross-Site Scripting issue. Restrict access to the template deletion feature to minimize the risk of credential exposure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-32172

GHSA-7J6X-42MM-P7JM

GO-2023-1896

Affected Products

Zinc

References · 9

• https://github.com/zinclabs/zinc/commit/3376c248bade163430f9347742428f0a82cd322d · Patch
• https://osv.dev/vulnerability/GO-2023-1896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7j6x-42mm-p7jm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32172 · Security Note
• https://github.com/zincsearch/zincsearch/commit/3376c248bade163430f9347742428f0a82cd322d · Note
• https://mend.io/vulnerability-database/CVE-2022-32172 · Note
• https://t.me/cvenotify/37214 · Telegram Post
• https://github.com/advisories/GHSA-7j6x-42mm-p7jm · Note