Description
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
Published:
2022-10-06
Score:
n/a
EPSS:
< 1% Very Low
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| zinc | zinc | affected |
|
No data.
No data available yet.
Remediation
Vendor Solution
Update version to v0.3.2 or later
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1950 | In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials. |
 Github GHSA |
GHSA-4fgv-8448-gf82 | Zinc Cross-site Scripting vulnerability |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Mend
Published:
Updated: 2024-09-17T01:41:50.446Z
Reserved: 2022-05-31T00:00:00.000Z
Link: CVE-2022-32171
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-10-06T18:16:02.610
Modified: 2024-11-21T07:05:52.620
Link: CVE-2022-32171
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses