CVE-2022-43983
published 2022-11-25CVE-2022-43983: Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate…
PriorityP338high8.2CVSS 3.1
AVNACLPRNUIRSCCHILAN
EPSS
0.64%
46.7th percentile
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spatie | browsershot | — | — |
| spatie | browsershot | >= 0 < 3.57.3 | 3.57.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Browsershot vulnerable to Cross-Site Scripting (XSS)
osv·2022-11-25
CVE-2022-43983 [MEDIUM] Browsershot vulnerable to Cross-Site Scripting (XSS)
Browsershot vulnerable to Cross-Site Scripting (XSS)
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
GHSA
Browsershot vulnerable to Cross-Site Scripting (XSS)
ghsa·2022-11-25
CVE-2022-43983 [MEDIUM] CWE-79 Browsershot vulnerable to Cross-Site Scripting (XSS)
Browsershot vulnerable to Cross-Site Scripting (XSS)
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-25
Published