PT-2022-27709 · Unknown · Shoplazza Lifestyle

Published 2022-12-18 · Updated 2022-12-22 · CVE-2022-4598

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shoplazza LifeStyle version 1.1

Description A vulnerability has been found in the Announcement Handler component, affecting an unknown functionality of the file /admin/api/theme-edit/. The manipulation of the Text and Mobile Text arguments leads to cross-site scripting. The attack can be launched remotely.

Recommendations For version 1.1, consider disabling the /admin/api/theme-edit/ endpoint until a patch is available. Restrict access to the Announcement Handler component to minimize the risk of exploitation. Avoid using the Text and Mobile Text arguments in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

CVE-2022-4598

Affected Products

Shoplazza Lifestyle

References · 7

• https://osv.dev/vulnerability/CVE-2022-4598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4598 · Security Note
• https://seclists.org/fulldisclosure/2022/Dec/11 · Note
• https://t.me/cvenotify/40431 · Telegram Post
• https://vuldb.com/?id.216193 · Note
• https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt · Note
• https://t.me/cibsecurity/54816 · Telegram Post