CVE-2022-39301CWE-434CWE-80

sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload

High · published October 19, 2022

CVSS v3.1
8.2
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in "Personal Center" - "Profile Picture Upload" allowing theft of the user's personal information. This issue has been patched in 1.1.2. There are no known workarounds.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00544 · 44.9th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2022-10-19T00:00Z
EPSS history
Timeline
  • 19 OCT 00:00Z
    sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload
    cvelistv5