Skip to content
OpenAdvisories
Unscored BSI-2022-0003 1 CVE

Stored Cross-Site Scripting (XSS) Vulnerability in csaf_provider

Published Nov 4, 2022 · Updated Nov 4, 2022 · en-US

Vendor: CSAF POC Product: csaf_provider

Vulnerabilities 1

  • Medium 5.4
    CVE-2022-43996

    csaf-poc/csaf_distribution Cross-site Scripting vulnerability

    The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently acc…

    github.com/csaf-poc/csaf_distribution Go

Revision history

  1. #1

    Initial version.