CVE-2022-30999CWE-79

Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

High · published May 25, 2022

CVSS v3.1
8.7
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01263 · 69.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-05-25T21:30Z
EPSS history
Timeline
  • 25 MAY 21:30Z
    Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
    cvelistv5