CVE-2022-1811
published 2022-05-23CVE-2022-1811: Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.71%
49.1th percentile
Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| publify | publify_publify | >= unspecified < 9.2.9 | 9.2.9 |
| publify_core | publify_core | >= 0 < 9.2.9 | 9.2.9 |
| publify_project | publify | < 9.2.9 | 9.2.9 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Publify vulnerable to cross site scripting
osv·2022-05-24
CVE-2022-1811 [CRITICAL] Publify vulnerable to cross site scripting
Publify vulnerable to cross site scripting
Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file. Stored XSS may be obtained.
GHSA
Publify vulnerable to cross site scripting
ghsa·2022-05-24
CVE-2022-1811 [CRITICAL] CWE-434 Publify vulnerable to cross site scripting
Publify vulnerable to cross site scripting
Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file. Stored XSS may be obtained.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-23
Published