PT-2022-21787 · Inventree · Inventree

Published 2022-09-29 · Updated 2022-09-30 · CVE-2022-3355

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Inventree versions prior to 0.8.3

Description The issue is related to stored Cross-site Scripting (XSS) in the GitHub repository inventree/inventree. This occurs by uploading SVG files, allowing for the storage of malicious scripts that can be executed when the uploaded file is accessed.

Recommendations For versions prior to 0.8.3, update to version 0.8.3 or later, which contains a patch for this issue. As a temporary workaround, consider restricting the upload of SVG files until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3355

GHSA-62G7-FPV9-V95F

Affected Products

Inventree

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3355.json · Exploit
• 🔥 https://huntr.dev/bounties/4b7fb92c-f06b-4bbf-82dc-9f013b30b6a6 · Exploit
• https://github.com/inventree/inventree/commit/5a08ef908dd5344b4433436a4679d122f7f99e41 · Patch
• https://osv.dev/vulnerability/CVE-2022-3355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3355 · Security Note
• https://osv.dev/vulnerability/GHSA-62g7-fpv9-v95f · Vendor Advisory
• https://github.com/inventree/InvenTree/releases/tag/0.8.3 · Note
• https://github.com/inventree/inventree · Note