CVE-2022-22117

Exploit

EPSS 0.63%
Veröffentlicht 10.01.2022 16:15:10
Zuletzt bearbeitet 21.11.2024 06:46:13
Erkennungen
Login

Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image

In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 153 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Rangerstudio ≫ Directus Version >= 9.0.1 <= 9.4.1

Rangerstudio ≫ Directus Version 9.0.0 Update -

Rangerstudio ≫ Directus Version 9.0.0 Update alpha10

Rangerstudio ≫ Directus Version 9.0.0 Update alpha11

Rangerstudio ≫ Directus Version 9.0.0 Update alpha12

Rangerstudio ≫ Directus Version 9.0.0 Update alpha13

Rangerstudio ≫ Directus Version 9.0.0 Update alpha14

Rangerstudio ≫ Directus Version 9.0.0 Update alpha15

Rangerstudio ≫ Directus Version 9.0.0 Update alpha16

Rangerstudio ≫ Directus Version 9.0.0 Update alpha17

Rangerstudio ≫ Directus Version 9.0.0 Update alpha18

Rangerstudio ≫ Directus Version 9.0.0 Update alpha19

Rangerstudio ≫ Directus Version 9.0.0 Update alpha20

Rangerstudio ≫ Directus Version 9.0.0 Update alpha21

Rangerstudio ≫ Directus Version 9.0.0 Update alpha22

Rangerstudio ≫ Directus Version 9.0.0 Update alpha23

Rangerstudio ≫ Directus Version 9.0.0 Update alpha24

Rangerstudio ≫ Directus Version 9.0.0 Update alpha25

Rangerstudio ≫ Directus Version 9.0.0 Update alpha26

Rangerstudio ≫ Directus Version 9.0.0 Update alpha27

Rangerstudio ≫ Directus Version 9.0.0 Update alpha31

Rangerstudio ≫ Directus Version 9.0.0 Update alpha32

Rangerstudio ≫ Directus Version 9.0.0 Update alpha33

Rangerstudio ≫ Directus Version 9.0.0 Update alpha34

Rangerstudio ≫ Directus Version 9.0.0 Update alpha35

Rangerstudio ≫ Directus Version 9.0.0 Update alpha36

Rangerstudio ≫ Directus Version 9.0.0 Update alpha37

Rangerstudio ≫ Directus Version 9.0.0 Update alpha38

Rangerstudio ≫ Directus Version 9.0.0 Update alpha39

Rangerstudio ≫ Directus Version 9.0.0 Update alpha4

Rangerstudio ≫ Directus Version 9.0.0 Update alpha40

Rangerstudio ≫ Directus Version 9.0.0 Update alpha41

Rangerstudio ≫ Directus Version 9.0.0 Update alpha42

Rangerstudio ≫ Directus Version 9.0.0 Update alpha5

Rangerstudio ≫ Directus Version 9.0.0 Update alpha6

Rangerstudio ≫ Directus Version 9.0.0 Update alpha7

Rangerstudio ≫ Directus Version 9.0.0 Update alpha8

Rangerstudio ≫ Directus Version 9.0.0 Update alpha9

Rangerstudio ≫ Directus Version 9.0.0 Update beta0

Rangerstudio ≫ Directus Version 9.0.0 Update beta1

Rangerstudio ≫ Directus Version 9.0.0 Update beta10

Rangerstudio ≫ Directus Version 9.0.0 Update beta11

Rangerstudio ≫ Directus Version 9.0.0 Update beta12

Rangerstudio ≫ Directus Version 9.0.0 Update beta13

Rangerstudio ≫ Directus Version 9.0.0 Update beta14

Rangerstudio ≫ Directus Version 9.0.0 Update beta2

Rangerstudio ≫ Directus Version 9.0.0 Update beta3

Rangerstudio ≫ Directus Version 9.0.0 Update beta4

Rangerstudio ≫ Directus Version 9.0.0 Update beta5

Rangerstudio ≫ Directus Version 9.0.0 Update beta7

Rangerstudio ≫ Directus Version 9.0.0 Update beta8

Rangerstudio ≫ Directus Version 9.0.0 Update beta9

Rangerstudio ≫ Directus Version 9.0.0 Update rc0

Rangerstudio ≫ Directus Version 9.0.0 Update rc1

Rangerstudio ≫ Directus Version 9.0.0 Update rc10

Rangerstudio ≫ Directus Version 9.0.0 Update rc100

Rangerstudio ≫ Directus Version 9.0.0 Update rc101

Rangerstudio ≫ Directus Version 9.0.0 Update rc11

Rangerstudio ≫ Directus Version 9.0.0 Update rc12

Rangerstudio ≫ Directus Version 9.0.0 Update rc13

Rangerstudio ≫ Directus Version 9.0.0 Update rc14

Rangerstudio ≫ Directus Version 9.0.0 Update rc15

Rangerstudio ≫ Directus Version 9.0.0 Update rc17

Rangerstudio ≫ Directus Version 9.0.0 Update rc18

Rangerstudio ≫ Directus Version 9.0.0 Update rc19

Rangerstudio ≫ Directus Version 9.0.0 Update rc2

Rangerstudio ≫ Directus Version 9.0.0 Update rc20

Rangerstudio ≫ Directus Version 9.0.0 Update rc21

Rangerstudio ≫ Directus Version 9.0.0 Update rc22

Rangerstudio ≫ Directus Version 9.0.0 Update rc23

Rangerstudio ≫ Directus Version 9.0.0 Update rc24

Rangerstudio ≫ Directus Version 9.0.0 Update rc25

Rangerstudio ≫ Directus Version 9.0.0 Update rc26

Rangerstudio ≫ Directus Version 9.0.0 Update rc27

Rangerstudio ≫ Directus Version 9.0.0 Update rc28

Rangerstudio ≫ Directus Version 9.0.0 Update rc29

Rangerstudio ≫ Directus Version 9.0.0 Update rc3

Rangerstudio ≫ Directus Version 9.0.0 Update rc30

Rangerstudio ≫ Directus Version 9.0.0 Update rc31

Rangerstudio ≫ Directus Version 9.0.0 Update rc32

Rangerstudio ≫ Directus Version 9.0.0 Update rc33

Rangerstudio ≫ Directus Version 9.0.0 Update rc34

Rangerstudio ≫ Directus Version 9.0.0 Update rc35

Rangerstudio ≫ Directus Version 9.0.0 Update rc36

Rangerstudio ≫ Directus Version 9.0.0 Update rc37

Rangerstudio ≫ Directus Version 9.0.0 Update rc38

Rangerstudio ≫ Directus Version 9.0.0 Update rc39

Rangerstudio ≫ Directus Version 9.0.0 Update rc4

Rangerstudio ≫ Directus Version 9.0.0 Update rc40

Rangerstudio ≫ Directus Version 9.0.0 Update rc41

Rangerstudio ≫ Directus Version 9.0.0 Update rc42

Rangerstudio ≫ Directus Version 9.0.0 Update rc43

Rangerstudio ≫ Directus Version 9.0.0 Update rc44

Rangerstudio ≫ Directus Version 9.0.0 Update rc45

Rangerstudio ≫ Directus Version 9.0.0 Update rc46

Rangerstudio ≫ Directus Version 9.0.0 Update rc47

Rangerstudio ≫ Directus Version 9.0.0 Update rc48

Rangerstudio ≫ Directus Version 9.0.0 Update rc49

Rangerstudio ≫ Directus Version 9.0.0 Update rc5

Rangerstudio ≫ Directus Version 9.0.0 Update rc50

Rangerstudio ≫ Directus Version 9.0.0 Update rc51

Rangerstudio ≫ Directus Version 9.0.0 Update rc52

Rangerstudio ≫ Directus Version 9.0.0 Update rc53

Rangerstudio ≫ Directus Version 9.0.0 Update rc54

Rangerstudio ≫ Directus Version 9.0.0 Update rc55

Rangerstudio ≫ Directus Version 9.0.0 Update rc56

Rangerstudio ≫ Directus Version 9.0.0 Update rc57

Rangerstudio ≫ Directus Version 9.0.0 Update rc58

Rangerstudio ≫ Directus Version 9.0.0 Update rc59

Rangerstudio ≫ Directus Version 9.0.0 Update rc6

Rangerstudio ≫ Directus Version 9.0.0 Update rc60

Rangerstudio ≫ Directus Version 9.0.0 Update rc61

Rangerstudio ≫ Directus Version 9.0.0 Update rc62

Rangerstudio ≫ Directus Version 9.0.0 Update rc63

Rangerstudio ≫ Directus Version 9.0.0 Update rc64

Rangerstudio ≫ Directus Version 9.0.0 Update rc65

Rangerstudio ≫ Directus Version 9.0.0 Update rc66

Rangerstudio ≫ Directus Version 9.0.0 Update rc67

Rangerstudio ≫ Directus Version 9.0.0 Update rc68

Rangerstudio ≫ Directus Version 9.0.0 Update rc69

Rangerstudio ≫ Directus Version 9.0.0 Update rc7

Rangerstudio ≫ Directus Version 9.0.0 Update rc70

Rangerstudio ≫ Directus Version 9.0.0 Update rc71

Rangerstudio ≫ Directus Version 9.0.0 Update rc72

Rangerstudio ≫ Directus Version 9.0.0 Update rc73

Rangerstudio ≫ Directus Version 9.0.0 Update rc74

Rangerstudio ≫ Directus Version 9.0.0 Update rc75

Rangerstudio ≫ Directus Version 9.0.0 Update rc76

Rangerstudio ≫ Directus Version 9.0.0 Update rc77

Rangerstudio ≫ Directus Version 9.0.0 Update rc78

Rangerstudio ≫ Directus Version 9.0.0 Update rc79

Rangerstudio ≫ Directus Version 9.0.0 Update rc8

Rangerstudio ≫ Directus Version 9.0.0 Update rc80

Rangerstudio ≫ Directus Version 9.0.0 Update rc81

Rangerstudio ≫ Directus Version 9.0.0 Update rc82

Rangerstudio ≫ Directus Version 9.0.0 Update rc83

Rangerstudio ≫ Directus Version 9.0.0 Update rc84

Rangerstudio ≫ Directus Version 9.0.0 Update rc85

Rangerstudio ≫ Directus Version 9.0.0 Update rc86

Rangerstudio ≫ Directus Version 9.0.0 Update rc87

Rangerstudio ≫ Directus Version 9.0.0 Update rc88

Rangerstudio ≫ Directus Version 9.0.0 Update rc89

Rangerstudio ≫ Directus Version 9.0.0 Update rc9

Rangerstudio ≫ Directus Version 9.0.0 Update rc90

Rangerstudio ≫ Directus Version 9.0.0 Update rc91

Rangerstudio ≫ Directus Version 9.0.0 Update rc92

Rangerstudio ≫ Directus Version 9.0.0 Update rc93

Rangerstudio ≫ Directus Version 9.0.0 Update rc94

Rangerstudio ≫ Directus Version 9.0.0 Update rc95

Rangerstudio ≫ Directus Version 9.0.0 Update rc96

Rangerstudio ≫ Directus Version 9.0.0 Update rc97

Rangerstudio ≫ Directus Version 9.0.0 Update rc98

Rangerstudio ≫ Directus Version 9.0.0 Update rc99

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.63%	0.455

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	3.5	6.8	2.9	AV:N/AC:M/Au:S/C:N/I:P/A:N
vulnerabilitylab@mend.io	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10

Patch

Third Party Advisory

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2022-22117

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-22117

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-22117

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-22117